signup/signin/forgot pages from main site should check for cookies

[shane-tomlinson]

The signup/signin pages do not check for whether the user has their cookies enabled before allowing the user to sign in.

[jrgm]

This should also include the /forgot page, of course.

[shane-tomlinson]

@jbonacci - is the above related to #1499? If so, are they separate bugs?

Using a new profile with cookies disabled in Chrome for OSX on diresworb.org/signin, I receive the following error message:

BrowserID requires cookies
Please close this window, enable cookies and try again
Action: Authenticating User
Network Info: POST: /wsapi/authenticate_user
Response Code - 403
Response Text: Forbidden: no cookie
Error Type: Forbidden: no cookie

Which is the same as I see on browserid.org:

BrowserID requires cookies
Please close this window, enable cookies and try again
Action: Authenticating User
Network Info: POST: /wsapi/authenticate_user
Response Code - 403
Response Text: Forbidden: no cookie
Error Type: Forbidden

[shane-tomlinson]

@jbonacci - can you look at #1489 - this makes it so the signup, signin, forgot, verify_email_address, and add_email_address pages all have a cookie check as soon as the user lands. If the user's cookies are disabled, a message will be displayed as soon as they land on the page. That means the user won't even have the opportunity to enter their email address in. This fix should also fix #1484 - Chrome excepting when cookies are disabled. @ozten merged PR-1489 into dev today (2012.04.25)

[jrgm]

404? Not found? For which URL. Or did you mean 403?

[jrgm]

So, I've used Win7/WinXP (IE9/IE8,Chrome,FF,Opera,Safari), OSX (Chrome,Safari,Opera,FF), Ubuntu Chrome,FF,Opera), Android4.0 (Stock,FF,Aurora), Android2.2 (Stock,FF), IOS5 (Safari) with cookies disabled and visiting /signin /signup etc. and popping the /sign_in dialog from an RP.

They all do immediately show the 'requires cookies' screen immediately on load, except GH-1542 where it doesn' t show for stock browser on Android 4.0 (but does show for stock/Android2.2).

I'll note in passing the that on mobile with Gecko browsers (either XUL or native) with the 'requires cookies' screen showing, touching links in the background show some visual and haptic response to the touch but don't actually have any effect.

@jbonacci - how do your issues with IOS/4.0+Safari+Never look on stage?

[jrgm]

Okay @jbonacci so verified.

[jrgm]

So #1418 (comment) and #1418 (comment) confirm this was done, but this issue wasn't closed. Closing now.