Reports of the key not working

[LucyeoH-zz]

Hey!

Over the past week or so we've had a few issues about people having problems with the key. Things like "The login key is not working. I tried for five minutes, but I didn't get the email for the key. Now I can't get into my account."

No report of error messages so it might be user error but though I'd file it here just in case.

[cadecairos]

We're going to need more info before being able to investigate the problem.

username, time when it happened, STR's to the best of their knowledge, etc.

[LucyeoH-zz]

@secretrobotron

[LucyeoH-zz]

Okay, so one of the people who emailed about this responded. He says his username is aaj. He says that when he first tried logging in, the key didn't work (claimed they were expired even though he was within the allotted time), and then it just stopped sending him keys altogether. I will continue to try and get more data from people who are having this problem, I'm still receiving new emails about it.

[secretrobotron]

@cadecairos is there -- I don't know -- some sort of pile of text that tells you information about what happened? Oh! Like a log?

[LucyeoH-zz]

STR:

1. Sign-out and go to webmaker.org
2. Click "sign-in"
3. Input email and click sign-in again
4. Click the "sign-in and remember me" link in the email

Expected: That it signs me and keeps me logged in
Actual: I am sent to Webmaker where I receive the error message "Uh Oh! Your login link expired. Request a new email to sign in."
Note: This happens whether or not you have successfully inputted the key previously on webmaker.org. cc. @cadecairos

[cadecairos]

I can log in fine with those STRs (tried five times in a row, three in FX, two in chrome)

There must be a missing step

[LucyeoH-zz]

@cadecairos so I went over this with @ScottDowne @alicoding and I was able to solve the problem by clearing my cookies. Maybe they can explain why it was an issue... Scott? Ali?

[cadecairos]

I may be wrong, but this might an issue with CSRF. Could there be some way the csrfSecret stored in the cookie might not be valid with the csrf token in the page?

[ScottDowne]

Yeah, I have been asking myself how a csrf could have an issue. A csrf created in an older version maybe?

The code that creates the cookie hasn't been changed since mid nov.

So maybe we changed how we interact with it?

I tried purposely breaking my csrf and while it did break, it broke in a way that wasn't what Lucy was seeing.

[cadecairos]

This is a longshot, but perhaps there's an app out there using an older version of webmaker-auth? There could be an incompatibility with how it is generating session cookies vs another app.

[cadecairos]

OR

What if this is a product of the plain JS adapter not clearing the search parameters after logging in?

for example, https://popcorn.webmaker.org/en-US/editor/?uid=fakeuser&token=bavut-husas&validFor=one-year will log you in the first time, but if for some reason, the user doesn't realize that they're logged in, and refreshes the page, it will try to use the credentials in the url again to log in (and it will fail, because they're one time use only)

This shouldn't be a problem with any page using the angular adapter because I made sure it clears the url parameters after it grabs the uid and key values.

I can see some kind of client-side loading error causing UI refresh issues after logging in (especially on non-angular webmaker-org pages, which might cause some users to refresh and/or try to click the link again.

[cadecairos]

I spoke with @ScottDowne about the problems @Lucyeoh was seeing on the /me page of webmaker.org

I think I understand why people think the login is failing on that page:

https://github.com/mozilla/webmaker.org/blob/dd852b5cfe1a64f538a50ba64c87066f0379faa0/public/js/pages/me.js#L15-L23

the login link will trigger a "login" event, which will trigger the reload function. reload basically reloads the entire url in the location bar (which includes the login link credentials) this causes the login error dialog to appear, making it seem like the login failed.

As for why Lucy was being automatically logged out, it could have been due to an old Cookie in her browser specifically, or a race case in how the browser was executing JS.

[thisandagain]

/cc @simonwex

[LucyeoH-zz]

@simonwex @cadecairos seeing as this might not get fixed immediately I'm wondering if we could consider adding a note to login that let's people know how to fix it.

"Having problems with login? Try clearing cookies from your browser history and then try and login again. It will send you another key that you should be able to copy and paste into the login browser. Here is a simple guide for clearing your cookies. https://support.mozilla.org/en-US/kb/delete-browsing-search-download-history-firefox#w_how-do-i-clear-my-history"

[LucyeoH-zz]

Other bug: #327