ubuntuone.com should test for acceptance of cookies

Bug #392101 reported by Rolf Leggewie
40
This bug affects 6 people
Affects Status Importance Assigned to Milestone
Canonical SSO provider
Fix Released
Medium
David Owen
Ubuntu One Servers
Confirmed
Undecided
Ubuntu One Client Engineering team

Bug Description

I'd actually prefer if ubuntuone.com did not use cookies at all, but I guess these days it is getting to be impossible for web masters to code without cookies ;-)

Signin will continually fail without a good error message indicating the reason if cookies for ubuntuone.com are blocked.

Tags: ops+ sp-2

Related branches

Revision history for this message
John O'Brien (jdobrien) wrote : Re: [Bug 392101] [NEW] ubuntuone.com should test for acceptance of cookies

Rolf Leggewie wrote:
> Signin will continually fail without a good error message indicating the
> reason if cookies for ubuntuone.com are blocked.

Did you get the following error? This is what I got with cookies disabled:

Unexpected form data

Launchpad doesn't understand the form data submitted in this request.

Paul Sladen (sladen)
affects: ubuntuone-client → ubunet
Revision history for this message
Rolf Leggewie (r0lf) wrote :

No. Again, there was no error message to speak of.

Revision history for this message
Joshua Hoover (joshuahoover) wrote :

I did a quick test of signing in via Firefox 3 on Ubuntu 9.04 and got the same error John O'Brien did:

Unexpected form data
Launchpad doesn't understand the form data submitted in this request.

Changed in ubunet:
importance: Undecided → Low
status: New → Confirmed
tags: added: foundations+
Revision history for this message
vikhyath (vikhyath-gmail) wrote :

temporary work around:

Enable cookies and login to launchpad, and use your launchpad account page
https://launchpad.net/~<userid>

on the top right on this page it says "log in"
click on it and don't close this page or log out.

Open this page in a new TAB
www.ubuntuone.com

now click on login

Revision history for this message
Joshua Hoover (joshuahoover) wrote :

Adding to Canonical SSO Provider project as I believe the requirement for cookies at login is controlled there.

tags: added: ops+
removed: foundations+
Changed in ubuntuone-servers:
assignee: nobody → Ubuntu One Desktop+ team (ubuntuone-desktop+)
importance: Low → Undecided
Changed in canonical-identity-provider:
milestone: none → 2.3.0
importance: Undecided → Medium
status: New → Confirmed
Revision history for this message
Stuart Metcalfe (stuartmetcalfe) wrote :

Bumping to our next release due to time constraints.

Changed in canonical-identity-provider:
milestone: 2.3.0 → 2.4.0
tags: added: sp-2
Revision history for this message
Anthony Lenton (elachuni) wrote :
Changed in canonical-identity-provider:
assignee: nobody → Łukasz Czyżykowski (lukasz-czyzykowski)
Changed in canonical-identity-provider:
assignee: Łukasz Czyżykowski (lukasz-czyzykowski) → nobody
Changed in canonical-identity-provider:
milestone: 2.4.0 → 2.5.0
Changed in canonical-identity-provider:
milestone: 2.5.0 → 2.6.0
Changed in canonical-identity-provider:
assignee: nobody → David Owen (dsowen)
Revision history for this message
David Owen (dsowen) wrote :

I can reproduce if I accept cookies from login.ubuntu.com but reject from one.ubuntu.com. The handle this scenario, one.ubuntu.com must check for cookie acceptance.

Revision history for this message
Stuart Metcalfe (stuartmetcalfe) wrote :

Arguably, both sites should check for cookies if they require them, as it's possible for a user to reject cookies for each site independently. SSO should certainly perform its own check.

David Owen (dsowen)
Changed in canonical-identity-provider:
status: Confirmed → In Progress
Changed in canonical-identity-provider:
status: In Progress → Fix Committed
David Owen (dsowen)
Changed in canonical-identity-provider:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.