983165 - Unable to sign out after changing password

Status: RESOLVED FIXED

(Cloud Services :: Server: Firefox Accounts, defect)

Description

[Catalin Suciu [:csuciu]]

Nightly 30.0a1 (2014-03-13)
Linux 12.04 x64

1. Sign-in in two separate profiles with the same Firefox account
2. On first profile, change the password 
3. On second profile go to manage account and try to sign out

Result: 'Invalid authentication token in request signature' message is displayed and the account still appears as signed in.

Comment 1

[Edwin Wong [:edwong]]

I think the expected behavior is that the client should offer a reauthenticate screen.

Comment 2

[:Gavin Sharp [email: [e-mail]]]

(In reply to Catalin Suciu from comment #0)
> 1. Sign-in in two separate profiles with the same Firefox account
> 2. On first profile, change the password 
> 3. On second profile go to manage account and try to sign out

Can you elaborate on how exactly you "Sign out"? Which things you click where etc.

> Result: 'Invalid authentication token in request signature' message is
> displayed and the account still appears as signed in.

Where is that message displayed? Can you perhaps attach a screenshot?

Comment 3

[Catalin Suciu [:csuciu]]

(In reply to :Gavin Sharp (email [e-mail]) from comment #2)
> (In reply to Catalin Suciu from comment #0)
> > 1. Sign-in in two separate profiles with the same Firefox account
> > 2. On first profile, change the password 
> > 3. On second profile go to manage account and try to sign out
> 
> Can you elaborate on how exactly you "Sign out"? Which things you click
> where etc.

After changing the password on first profile, go to the second profile and open 'Manage account' page (https://accounts.firefox.com/settings) via Preferences > Sync >  Manage and click on the 'Sign Out' link 
> 
> > Result: 'Invalid authentication token in request signature' message is
> > displayed and the account still appears as signed in.
> 
> Where is that message displayed? Can you perhaps attach a screenshot?

Please see the attached screenshot

Comment 4

[Catalin Suciu [:csuciu]]

Attachment: Screenshot from 2014-03-14 09:16:57.png

Comment 5

[Chris Karlof [:ckarlof]]

Hi Catalin,

Thanks for the screenshot and STR!

This issue was also reported here: https://github.com/mozilla/fxa-content-server/issues/616
and a fix was landed here: https://github.com/mozilla/fxa-content-server/issues/649

However, this fix has not made it to production yet. The train was cut at the beginning of the week, and I'm not sure right now of its status. 

Longer term, that sign out link doesn't really do what it looks like it should do (i.e., sign you out of the browser), so we're likely going to remove that link when the settings page is shown after clicking "Manage" in the browser: https://github.com/mozilla/fxa-content-server/issues/612#issuecomment-36915384

I'm marking this as resolved-fixed, but please verify it, say, in one week's time after the appropriate FxA server changes have been deployed. Thanks!

Comment 6

[:Gavin Sharp [email: [e-mail]]]

(The sign-out issue is also tracked in bug 968353)