968353 - sign out in hosted about:accounts page doesn't sign you out of Fx UI

Status: RESOLVED FIXED

(Firefox :: Sync, defect)

Description

[Edwin Wong [:edwong]]

1. launch nightly and setup sync by signing in with an FxA
2. confirm signed in state, you should see a door hanger drop or 'sync now' in menu
3. click preferences > manage
4. in the hosted page, click sign out

actual: all the Fx UI displays you in signed in state.

expected: you shouldn't be signed in.

Comment 1

[Edwin Wong [:edwong]]

moving component

Comment 2

[:Gavin Sharp [email: [e-mail]]]

IIRC we decided we'd remove that "Sign out" link (from https://accounts.firefox.com/settings)?

Comment 3

[Chris Karlof [:ckarlof]]

This is a UX challenge. FxA on the Web will have its own "signed in" state, and we need a way to log out of it. However, we need to signal that this won't log you out of Sync.

Comment 4

[Tracy Walker [:tracy]]

If you restart the browser after logging out of FxA, UI then shows logged out/sync disconnected state.  

Chris are you saying for current session (the one in which you logged out), that Sync should continue to work?

Comment 5

[Chris Karlof [:ckarlof]]

W(In reply to [:tracy] Tracy Walker - QA Mentor from comment #4)
> If you restart the browser after logging out of FxA, UI then shows logged
> out/sync disconnected state.  
> 

Which UI, the browser sync pref UI or about:accounts?

> Chris are you saying for current session (the one in which you logged out),
> that Sync should continue to work?

It's likely a bug that you can get to a state in about:accounts that shows a "sign out" link. We should fix it. However, if you click "manage" in the sync browser prefs, it will open "accounts.firefox.com", which after you log in, will have a "log out" link. This is totally expected, because it's just a web page for the accounts portal. "Log out" here just logs you out of the account portal, not your browser. I think we can improve this experience, but it will take some thought.

Comment 6

[Tracy Walker [:tracy]]

(In reply to Chris Karlof [:ckarlof] from comment #5)
> W(In reply to [:tracy] Tracy Walker - QA Mentor from comment #4)
> > If you restart the browser after logging out of FxA, UI then shows logged
> > out/sync disconnected state.  
> > 
> 
> Which UI, the browser sync pref UI or about:accounts?
> 

about:accounts shows Manage, which goes to Sync Prefs, which is logged out of sync. So both.

Comment 7

[Brian Warner [:warner :bwarner]]

I think Karl and I got to this "sign out" page by using a new profile to sign into an account that was already email-verified. The email/password-entry page was replaced by the "Manage account" web page, which included the "Sign out" link. Clicking this link destroyed the session token (so now the browser couldn't sync any more), but didn't inform the chrome-side code that the session was dead (so the "hamburger" menu continued to show the signed-in email address). Restarting the browser and clicking on the hamburger menu caused it to realize token was invalid, and it went back to the "Reconnect to Sync" state.

Comment 9

[Chris Karlof [:ckarlof]]

It's not intended that a user should get to this page when they sign into sync. This page is currently shown when a user signs into sync with a previously verified account. I've opened Bug 976828 to fix that issue.

A second issue is that since this page is intended to be the landing page for signing into FxA on the Web, clicking "Sign out" here *shouldn't* log you out of Sync, which it currently does, and that's a bug. Tracking that here: https://github.com/mozilla/fxa-content-server/issues/612.

Comment 10

[Chris Karlof [:ckarlof]]

The work described here: https://github.com/mozilla/fxa-content-server/issues/612#issuecomment-36915384

should fix this issue. Summary: the sign out link will not be shown here when you're signed in to Desktop Firefox.

Comment 11

[Chris Karlof [:ckarlof]]

The above fix was deployed yesterday. It should now not suggest you can sign out of sync in about:accounts.

Comment 12

[Edwin Wong [:edwong]]

I've verified that sign out no longer appears in about:accounts.  sign out will appear in accounts.firefox.com/settings so you can sign out of FxWeb in other browsers.  The issue of signing out of the desktop Fx UI exists but that's in bug 985535

Comment 13

[Ioana (away)]

I tried to reproduce this several times on the 02/05 Nightly in order to verify it afterwards. I couldn't get a sign out link in about:accounts tough.

Edwin, what Firefox version did you verify this on in comment 12? Could you please make sure this is fixed for you in Firefox 29?

Comment 14

[Edwin Wong [:edwong]]

You should NOT see a 'sign out' link when you are signed into about:accounts, which confirms comment 10.  So i think you're seeing the correct behavior.  I believe, when you sign into browser via about:accounts, you are automatically signed into accounts.firefox.com/settings.  You now have a session which is detected to hide the 'sign out' link.  You can manually sign out by clearing session cookies/data.

Comment 15

[Ioana (away)]

(In reply to Edwin Wong [:edwong] from comment #14)
> You should NOT see a 'sign out' link when you are signed into
> about:accounts, which confirms comment 10.  So i think you're seeing the
> correct behavior.  I believe, when you sign into browser via about:accounts,
> you are automatically signed into accounts.firefox.com/settings.  You now
> have a session which is detected to hide the 'sign out' link.  You can
> manually sign out by clearing session cookies/data.

As I specified in comment 13, I see the correct behavior on the build one should reproduce the bug with. This means I can't reproduce the bug on my machine at all, ergo I can't verify it either.

Removing qa+ since this can't be verified reliably.