[HOLD for payment 2024-05-21] [$125] BA - Unable to confirm on double check Personal info page, error appears

[kavimuru]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 1.4.51-1
Reproducible in staging?: y
Reproducible in production?: no
If this was caught during regression testing, add the test name, ID and link from TestRail: https://expensify.testrail.io/index.php?/tests/view/4418483
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: applause internal team
Slack conversation:

Action Performed:

Pre-requisite: the user must be logged in and have created a Workspace.

1. Go to Workspace > Bank account.
2. Select Connect manually.
3. Enter "011401533" and "1111222233331111" for Routing number and Account number.
4. On Personal info, use "First" and "Last" for first name and last name.
5. Enter random data on the rest of the fields.
6. On double check Personal info, try to confirm.

Expected Result:

The user should be able to confirm on double check Personal info page and proceed to Onfido flow.

Actual Result:

The user is not able to confirm on double check Personal info page.

Workaround:

unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6411893_1710305344794.bandicam_2024-03-12_17-46-07-591.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01f8390f05597b3838
• Upwork Job ID: 1770107180384727040
• Last Price Increase: 2024-05-21
• Automatic offers:
• s77rt | Reviewer | 0
• tienifr | Contributor | 0

Issue Owner

Current Issue Owner: @abekkala

[melvin-bot]

Triggered auto assignment to @abekkala (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[melvin-bot]

Triggered auto assignment to @cristipaval (Engineering), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[kavimuru]

@cristipaval FYI I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors.

[shubham1206agra]

Unable to repro this.

[mountiny]

@kavimuru can you share the console/ networks tab to see what was the error of the API call?

From the logs, it seems like we were not able to verify the name and date of birth and hence it failed Please verify your name and date of birth. If the information is correct

Is this supposed to work for other than the Alberta Bobbeth Charleson names?

[mountiny]

I think this can be demoted, but wont do so until its the last blocker

[cristipaval]

I could reproduce this, and I have similar logs
It's the error stated by @mountiny above. I think we should show a better error message, but I wouldn't block the deploy on this.

[mountiny]

Confirmed with @MariaHCD this is expected given if we use different name than Alberta Charleson the checks are being done so in this case it fails.

I agree with Cristi that better error should be shown, not sure if you want to handle that here, I assume we can add this to Wave collect as polish

[melvin-bot]

@abekkala, @cristipaval Huh... This is 4 days overdue. Who can take care of this?

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~01f8390f05597b3838

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @s77rt (External)

[tienifr]

I'm sorry I linked the wrong issue.

[tienifr]

PR ready for review #39012.

[abekkala]

I'm back from ooo and taking this one back

[abekkala]

PR has not been merged yet

[tienifr]

I found the root problem of this:

The Content-Security-Policy set in the backend is lacking https://sdk.onfido.com/v14/Onfido.is endpoint:

This happens on both staging and production. This is very critical since access to Onfido SDK is no longer working. And this requires a fix the backend. There's a suggested solution by Onfido here. It has nothing to do with the personal data.

@mountiny @cristipaval We found the root cause of this issue is about Content-Security-Policy. I think that is a very critical issue happening on production and needs immediate action.

Also, we don't need to show Onfido errors because:

• All of the errors are related to BE configurations. It has nothing to do with user personal data in confirm step. We can still show the error, while user can't have any action, it's good for the developers to debug.
• Onfido is only responsible for face and document verification. If there was any error during that step, Onfido would show its own error notification.

So I think we can close the PR and fix root cause in the BE as mentioned above.

[mountiny]

Created an internal PR to address this https://github.com/Expensify/Cloudflare-Workers/pull/137/files

[mountiny]

@tienifr @s77rt can you please retest now? the backend fix should be out

[s77rt]

@mountiny https://sdk.onfido.com was added to the style-src whitelist. It should be script-src

[mountiny]

Thanks, waiting for deployment of the update 🤦

Its correct for adhoc builds only, overlooked that the assets.onfido been for style-src as well as script-src

[tienifr]

The fix is live on production. I remembered the font issue was already handled somewhere else 🤔 Just want to ask if I and @s77rt got compensated because large efforts were put into PR implementation, review, testing and finding the RCA of this issue.

[tienifr]

@mountiny Could you please check the above ^ when you had time?

[tienifr]

@abekkala @mountiny Could you check my ^ comment?

[mountiny]

I think we can pay $125 each for your work and help identifying the root cause

[mountiny]

$125 to @tienifr and @s77rt

[melvin-bot]

Upwork job price has been updated to $125

[abekkala]

Payments sent and contracts ended! thanks!