965050 - Request that ADP switch to use <object> or <iframe> instead of <embed> for embedded PDFs at portal.adp.com, so that PDF.js can render them without tripping over CSP restrictions

Status: RESOLVED INVALID

(Web Compatibility :: Site Reports, defect)

Description

[Daniel Holbert [:dholbert]]

As described in bug 965003, ADP's new https://portal.adp.com site will not render PDF paystubs, W2s, etc (or allow them to be downloaded) in Firefox with the (default) PDF.js PDF-viewer, due to CSP restrictions. (because <embed> loads PDF.js-rendered content using a modified URI which runs afoul of their CSP)

See steps to reproduce in bug 965003.

If ADP switches their site to use <object> or <iframe> (instead of <embed>) for these PDFs, then everything works correctly.

I'm filing this bug on making this recommendation/request to them, so that Firefox users (and Mozilla employees ;)) can see their paystubs.

For comparison, ADP's older https://ipay.adp.com site uses <iframe> to embed paystubs (which works fine).

Comment 1

[Daniel Holbert [:dholbert]]

I tweeted @ADP to get the ball rolling here:
 https://twitter.com/CodingExon/status/428326926650847232

(If anyone has connections at ADP or knows of another way to contact engineering folks over there, please post here, or better yet, just directly use that channel to ask them if they could make the change described in this bug.)

Also: for convenience, I'm copypasting the STEPS TO REPRODUCE from bug 965003, so it's clear what part of the site I'm talking about here.

STEPS TO REPRODUCE:
0. Be a US-based Mozilla employee or have an account with ADP.

 1. Log in to the new ADP page (which payroll@ recently notified us about in an email to US employees):
     http://www.portal.adp.com/
    (Your existing ADP iPay credentials will work.)

 2. Under the "Pay & Taxes" menu, pick "Pay Statements"

 3. Click one of the Pay Date entries, to try to view a paystub.

EXPECTED RESULTS: PDF should be rendered (by PDF.js) in the large <embed> area on the page

ACTUAL RESULTS: The PDF is not rendered, and there's no way (as far as I can tell) to download it. Moreover, this appears in the error console:
{
Content Security Policy: The page's settings blocked the loading of a resource at data:application/x-moz-playpreview-pdfjs;, ("default-src https://portal.adp.com:443 https://*.adp.com:443 https://*.google.com:443").
}

(And as indicated in comment 0 here, this is fixed if ADP could replace their <embed> with an <iframe> or an <object>.)

Comment 2

[Adam Stevenson [:adamopenweb]]

A quick Google search shows the email address format: [e-mail], which may be helpful.

Also found a recruiter at ADP that might be able to able: http://www.linkedin.com/in/saprecruiterlaura

Will reach out to her.

Comment 3

[Mike Taylor [:miketaylr]]

I think we can close this as INVALID. Apparently we need to use workforcenow.adp.com, and I just tested and pdf.js is working as epected (it's possible they fixed it before they migrated -- thanks for reach out Adam!).