New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 803206 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Regression



Sign in to add a comment

pop up windows that switch to the domain continue to have domain access errors

Reported by timothyr...@gmail.com, Jan 17 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce the problem:
1. sign out of google
2. go to https://testing.airclass.com
3. click the Google button to sign in with google
4.  Enter google credentials and submit

What is the expected behavior?
At this point, the pop up window should close and you should go to a registration page to complete registration with the linked google account

What went wrong?
Due to a Chrome 63 (or possibly 62) update, some oauth code that continually checks the popup url to be changed back to the same domain (testing.airclass.com), continues to throw the following error even when the domains of the popup and main window match.

I've attached a screenshot of the error that is continually being caught.  This worked in Chrome 61 and still works in Firefox.

Did this work before? Yes 61 for sure

Does this work in other browsers? N/A

Chrome version: 63.0.3239.132  Channel: stable
OS Version: 10.0
Flash Version:
 
Screenshot - 1_17_2018 , 1_35_05 PM.png
15.5 KB View Download
I've just noticed this issue doesn't occur when signing in via Microsoft.  This would seemingly point to an issue with google's oauth page, but I'm not as sure about the source of the issue now.  Any advise?
Labels: Needs-Bisect Needs-Triage-M63
Cc: sc00335...@techmahindra.com
Components: Internals>Network>DomainSecurityPolicy
Labels: TE-NeedsTriageFromMTV Triaged-ET
Unable to check this issue from ET/Inhouse team as this site https://testing.airclass.com/ is blocked in India. On navigating seeing "The Amazon CloudFront distribution is configured to block access from your country." error. 

Could someone from MTV team please have a look at this issue.

Thanks!
Components: -Internals>Network>DomainSecurityPolicy Blink>SecurityFeature>SameOriginPolicy
Labels: Needs-Feedback
Germany here, I also get 403 with "The Amazon CloudFront distribution is configured to block access from your country."


Several of the developers (including myself) who are working on the same origin policy (which seems to be the issue, judging from the screenshot provided in the report) are working in countries that are blocked by the repro server, meaning we cannot reproduce or examine the case. The submitter might want to consider making a repro case available more broadly.


I'll see if I can get more information in any case, but for now the bug status is effectively "cannot reproduce".
Status: WontFix (was: Unconfirmed)
- I got access to a US computer. This gives me access to the "airclass" site.
- When I sign in via the Google button with a test account, I get all sorts of errors, but not the one in the screenshot in error report.
- Tested in Chrome 64.0.3282.119

Errors I see in the console:
- Warning: SSL certificate used to load resources... will be distrusted in M70.
- FIREBASE WARNING: The Firebase database .... has exceeded its quota limit and has been temporarily disabled.
- Failed to load resource: the server responded with a status of 504.
- Status code 504 error. Attempting again in 0.2 seconds.
- Error: no id_token.

Setting to WontFix because I cannot reproduce.

Submitter: Please add more information on how to reproduce this, then set the status back to 'Unconfirmed'.  Ideally make sure this is reproducable from anywhere.


That site was down on the day you accessed it, but should be restored in a couple of days.   

Also, we have implemented a work-around by altering the oauth code to use window.postMessage() instead of the checking the popup url.  So, that testing.airclass.com site will probably work fine the next time it is accessible.  I'd need to set up a separate page to demonstrate this issue to move forwards it would seem.

Sign in to add a comment