Janrain engage: token_url not called from Firefox - firefox

I have an application using Janrain Engage for login.
Everything works since few months, except on ONE machine from Firefox...
I have no clue for what reason, when I try to log-in from this machine (on my site or even on Janrain's admin site), I get the sign-in page, the I choose a provider, enter my information, validate and then, nothing happens !
Normal process trace is:
GET
https://XXXXXXX.rpxnow.com/signin/get_login_info?widget_type=auth&provider=google&time=1358864872301 [HTTP/1.1 200 OK 1144ms]
POST http://XXXXXXX.rpxnow.com/redirect?loc=yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy [HTTP/1.1 200 OK 2533ms]
POST https:// my_token_url_on_mydomain [HTTP/1.1 302 Found 3667ms]
On the faulty machine, I just have the first GET, and then nothing else...
The token_url callback is never called, so I even do not have any trace on my server.
The machine where the problem occurs is my personnal machine at home. Same login attemps works like a charm with Chrome or IE. I did'nt find any specific settings in my Firefox configuration.
I'm afraid some potential customers can get the same behaviour as me and go away... Is anyone experimenting similar problem ?

Froggy. You might have 3rd party cookies disabled in Firefox. That's the only thing I can think of that would cause that issue on a single browser. Go here for info on changing that setting: http://support.mozilla.org/en-US/kb/disable-third-party-cookies/

Related

Firefox seems to fail on registering a ServiceWorker for Push Notifications?

Firefox seems to fail on registering a ServiceWorker for Push Notifications, with an error "InvalidStateError: An attempt was made to use an object that is not, or is no longer, usable", but the code works in Chrome and Edge, and appears to be compliant with the examples online and the spec.
I've thrown an example up on one of my test sites, https://wiegandtech.net/ - visiting it in Chrome will prompt for permission and then opt-in successfully, sending the info to the server. But Firefox prompts, doesn't complete the registration, and doesn't fire any error or throw anything into the console. When I try to debug, it seems to never return from navigator.serviceWorker.ready.then call - I debug in and reg is undefined, even though the promise says it shouldn't be. I can find no reason why this is failing. I do see in Fiddler that FF gets the worker file, so it appears to be starting the call, but never finishing? The worker is valid JavaScript, as far as I can tell. Does anyone have any documentation on how Firefox's implementation is different from Chrome's/the spec?
Firefox requires the ServiceWorker's URL to end in .js - I was using an ASP.Net site and returning javascript but through my own controller. When I just give it the URL for the .js file itself, it now works. Would file a bug, but too non-trivial to setup a site given that ServiceWorkers require a real life site to troubleshoot, and their source code doesn't appear to be on github.

Why is my meteor app getting these errors on firefox but not other browsers?

The web app that I am building in meteor works in chrome and I.E.(Other than a UI bug in I.E.) but it starts acting strange in Firefox. When I run it on my localhost and on the deployment to meteor.com, I don't get any errors in the console in the browsers' developer tools.
When I run it in Firefox, things start acting weird. On Mac OSX, if I run the app on my localhost and open it in FF it is just fine. However, when I open up the app that deployed to meteor.com via meteor deploy [my-app-url].com, I get the following errors but I can still use everything in my app:
Error 1:
mutating the [[Prototype]] of an object will cause your code to run very slowly;
instead create the object with the correct initial [[Prototype]] value using Object.create
Error 2:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource
at https://ddp--3071-[my-app-url].com/sockjs/info?cb=v9pygo9mzn.
(Reason: CORS request failed).
While right now I am not able to figure out what is causing the first error, I am mostly worried about the second error.
When I open up the app from it's deployment in FF on Windows 8, I get the first error once, and then I get the second error repeatedly and the app never loads(it just stays on my loading template from the iron router). My deployed app runs just fine on Chrome and I.E.
I don't send any kind of request to another server in my app, so I am not sure why I am getting a CORS request error. I have not set up SSL or began to make a certificate yet, so I am not sure if this could be causing this kind of error in FF as I got another exception on my login page in FF on my localhost saying that I shouldn't have password elements when I'm not using https.
Does anyone know what could be causing this?
Sorry that I provide any code, as I don't know what code I would post to solve this problem since I don't actually request anything from another server in code that I have written.
Thanks in advance for any responses!
If anyone is interested, it seems as if my combination of the aldeed:collectio2 package and one of my other packages was the cause of my problems. I removed this package and my issues went away.

Firefox Websocket security issue

We have a websocket server on port 8080 setup on a Linode box. Chrome and Opera work just fine. Firefox however complains that the operation is insecure.
"The operation is insecure: Code 18"
If I try to create a new WebSocket object in the web console before the page is loaded everything is fine. However, after the page loads something is screwy then I cannot create the object anymore. See the attached screenshot.
I have no idea what operation is insecure or even how to go about diagnosing this.
As you point out in another answer, https:// to ws:// is disallowed by default on firefox.
Going to firefox's about:config and toggling network.websocket.allowInsecureFromHTTPS will get rid of the SecurityError.
I fixed this. The app itself is under SSL but the websocket being accessed is not. Chrome and Opera don't care but Firefox does. According to:
https://bugzilla.mozilla.org/show_bug.cgi?id=303952
This is known and is not considered a bug. Mozilla's response: wontfix
Solution, put websocket server under SSL and use wss://
This is a hunch based off limited info, and I probably should put this into a comment, but I don't have enough reputation points to do that yet.
Looking at your log, it seems as if 24 seconds are passing from the receipt of [object Websocket] (time 17:46:36.683) until you get The connection to ws://.....(time 17:47:00:952) error message.The long delay leads me to believe that the server could be timing out and closing the websocket connection. Look at this answer for a potential solution.
Had the same problem and attempted to fix by changing network.websocket.allowInsecureFromHTTPS in about:config which did not work.
Ended up finding this post => Unhandled Rejection (SecurityError): The operation is insecure. On a fresh create-react-app project
Changing this in index.js ended up working for me
serviceWorker.register();
//serviceWorker.unregister();
Open "about:config" url in firefox. Search for allowInsecureFromHTTPS and set it to true
Beside secure ssl context and cross-origin policies, assigning some port can trigger the error as well.
What are valid http ports for Firefox? I don't know precisely, but have to be between 1500 and 64000, or the console will display:
SecurityError: The operation is insecure.
And http links will say:
This address is restricted
This address uses a network port which is normally used for purposes other than Web browsing.
Firefox has canceled the request for your protection.

Qt4.8 : QWebView and HTTPS

After having had a hell of a time to make SSL works on Qt with windows, most HTTPS website seem to be working. Untrusted certificate are now added when required and such, well everything is fine ... BUT I can't login on reuters.com for some weird reason.
Take a QWebView, add a bit of magic to handle ssl errors that shows up, go on reuters then click on sign in.
Then something weird occurs. First of all, it requested acceptance of untrusted certificates, which ain't that weird. But then, once that is done, nothing happens. QWebView waits and never send the loadFinished(bool) signal. More over the web page displayed doesn't change.
When I try to do this on Firefox or IE, it tells me that there is mixed content on the webpage. Could it be the problem?

Why is AJAX returning HTTP status code 0?

For some reason, while using AJAX (with my dashcode developed application) the browser just stops uploading and returns status codes of 0. Why does this happen?
Another case:
It could be possible to get a status code of 0 if you have sent an AJAX call and a refresh of the browser was triggered before getting the AJAX response. The AJAX call will be cancelled and you will get this status.
In my experience, you'll see a status of 0 when:
doing cross-site scripting (where access is denied)
requesting a URL that is unreachable (typo, DNS issues, etc)
the request is otherwise intercepted (check your ad blocker)
as above, if the request is interrupted (browser navigates away from the page)
Same problem here when using <button onclick="">submit</button>. Then solved by using <input type="button" onclick="">
Status code 0 means the requested url is not reachable. By changing http://something/something to https://something/something worked for me. IE throwns an error saying "permission denied" when the status code is 0, other browsers dont.
It is important to note, that ajax calls can fail even within a session which is defined by a cookie with a certain domain prefixed with www. When you then call your php script e.g. without the www. prefix in the url, the call will fail and viceversa, too.
Because this shows up when you google ajax status 0 I wanted to leave some tip that just took me hours of wasted time... I was using ajax to call a PHP service which happened to be Phil's REST_Controller for Codeigniter (not sure if this has anything to do with it or not) and kept getting status 0, readystate 0 and it was driving me nuts. I was debugging it and noticed when I would echo and return instead of exit the message I'd get a success. Finally I turned debugging off and tried and it worked. Seems the xDebug debugger with PHP was somehow modifying the response. If your using a PHP debugger try turning it off to see if that helps.
I found another case where jquery gives you status code 0 -- if for some reason XMLHttpRequest is not defined, you'll get this error.
Obviously this won't normally happen on the web, but a bug in a nightly firefox build caused this to crop up in an add-on I was writing. :)
This article helped me. I was submitting form via AJAX and forgotten to use return false (after my ajax request) which led to classic form submission but strangely it was not completed.
"Accidental" form submission was exactly the problem I was having. I just removed the FORM tags altogether and that seems to fix the problem. Thank you, everybody!
I had the same problem, and it was related to XSS (cross site scripting) block by the browser. I managed to make it work using a server.
Take a look at: http://www.daniweb.com/web-development/javascript-dhtml-ajax/threads/282972/why-am-i-getting-xmlhttprequest.status0
We had similar problem - status code 0 on jquery ajax call - and it took us whole day to diagnose it. Since no one had mentioned this reason yet, I thought I'll share.
In our case the problem was HTTP server crash. Some bug in PHP was blowing Apache, so on client end it looked like this:
mirek#toccata:~$ telnet our.server.com 80
Trying 180.153.xxx.xxx...
Connected to our.server.com.
Escape character is '^]'.
GET /test.php HTTP/1.0
Host: our.server.com
Connection closed by foreign host.
mirek#toccata:~$
where test.php contained the crashing code.
No data returned from the server (not even headers) => ajax call was aborted with status 0.
In my case, it was caused by running my django server under http://127.0.0.1:8000/ but sending the ajax call to http://localhost:8000/. Even though you would expect them to map to the same address, they don't so make sure you're not sending your requests to localhost.
In our case, the page link was changed from https to http. Even though the users were logged in, they were prevented from loading with AJAX.
In my case, setting url: '' in ajax settings would result in a status code 0 in ie8.. It seems ie just doesn't tolerate such a setting.
For me, the problem was caused by the hosting company (Godaddy) treating POST operations which had substantial response data (anything more than tens of kilobytes) as some sort of security threat. If more than 6 of these occurred in one minute, the host refused to execute the PHP code that responded to the POST request during the next minute. I'm not entirely sure what the host did instead, but I did see, with tcpdump, a TCP reset packet coming as the response to a POST request from the browser. This caused the http status code returned in a jqXHR object to be 0.
Changing the operations from POST to GET fixed the problem. It's not clear why Godaddy impose this limit, but changing the code was easier than changing the host.
I think I know what may cause this error.
In google chrome there is an in-built feature to prevent ddos attacks for google chrome extensions.
When ajax requests continuously return 500+ status errors, it starts to throttle the requests.
Hence it is possible to receive status 0 on following requests.
In an attempt to win the prize for most dumbest reason for the problem described.
Forgetting to call
xmlhttp.send(); //yes, you need this pivotal line!
Yes, I was still getting status returns of zero from the 'open' call.
In my case, I was getting this but only on Safari Mobile. The problem is that I was using the full URL (http://example.com/whatever.php) instead of the relative one (whatever.php). This doesn't make any sense though, it can't be a XSS issue because my site is hosted at http://example.com. I guess Safari looks at the http part and automatically flags it as an insecure request without inspecting the rest of the URL.
In my troubleshooting, I found this AJAX xmlhttpRequest.status == 0 could mean the client call had NOT reached the server yet, but failed due to issue on the client side. If the response was from server, then the status must be either those 1xx/2xx/3xx/4xx/5xx HTTP Response code. Henceforth, the troubleshooting shall focus on the CLIENT issue, and could be internet network connection down or one of those described by #Langdon above.
In my case, I was making a Firefox Add-on and forgot to add the permission for the url/domain I was trying to ajax, hope this saves someone a lot of time.
Observe the browser Console while making the request, if you are seeing "The Same Origin Policy disallows reading the remote resource at http ajax..... reason: cors header ‘access-control-allow-origin’ missing" then you need to add "Access-Control-Allow-Origin" in response header. exa: in java you can set this like response.setHeader("Access-Control-Allow-Origin", "*") where response is HttpServletResponse.

Resources