GaiaWebAuthFlow uses the main cookie store but no channel ID service. |
||
Issue descriptionA CookieStore must be used with the same channel ID service (Which may be a NULL service). Using the same CookieStore with a channel ID service and then without one leads to problems - generally, the server will throw out the cookies, or otherwise be very sad, since if it sees the same cookies with channel ID and then without them, it may assume they've been hijacked. This regressed in https://codereview.chromium.org/2145103003. Ideally, because of the complexities involved, the code would just use the main URLRequestContext, and LOAD_DO_NOT_SAVE_COOKIES / LOAD_DO_NOT_SEND_COOKIES if it doesn't want cookies or channel ID.
,
Aug 2 2016
Good catch - I missed that when I previously reviewed that CL. (That change was made because it was creating a bound token in the profile request context, and then using that token in a fresh app request context later.) I think the fix here is to have GaiaWebAuthFlow go back to using the main URLRequestContext and have WebAuthFlow use the same URLRequestContext as GaiaWebAuthFlow (that's where the bound token was getting passed across contexts).
,
Apr 18 2017
,
Apr 18 2017
[anthonyvd]: This looks to be a different bug from the one you merged it into.
,
Apr 18 2017
The crash in the other bug is due to the code that copies the URLRequestContext temporarily. From what I understand, the solution to both issues is what you suggest in the OP. Am I missing something?
,
Apr 18 2017
The other bug is because URLRequests are alive at shutdown. This bug is because it's creating an invalid URLRequestContext - a cookie store and channel ID store must always match. So you can't just "borrow" someone else's cookie store, and then create a network session with another (Or no) channel ID store.
,
Apr 18 2017
Wouldn't both be fixed by not using a temporary URLRequestContext though? I'm happy to unmerge them if my assumption is incorrect :)
,
Apr 18 2017
Sorry, misread your earlier comment - yea, you're right, as long as the service is shut down before the ProfileIOData is. |
||
►
Sign in to add a comment |
||
Comment 1 by mmenke@chromium.org
, Aug 2 2016