User Agent: Mozilla/5.0 (X11; CrOS x86_64 11316.165.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.122 Safari/537.36
Related issue: https://github.com/mozilla-mobile/firefox-ios/issues/3150
Steps to reproduce:
There is currently no way to specify a custom URL for a Firefox Sync Server (token url) while using the publicly available, Mozilla-hosted Firefox Accounts service.
Actual results:
There is no option to do this.
Expected results:
There should be an option like on Android to specify to custom token URL for self-hosted sync server. This option is available on desktop Firefox and on Firefox for Android.
Jerry Heiselman:
I have attempted to create a fxa-client-configuration file located at https://thor.heiselman.com/.well-known/fxa-client-configuration that mirrors the one served by accounts.firefox.com with the one change being the URL for the sync tokenserver url to point to my own.
When configuring this URL in Firefox on iOS using the method of revealing the hidden Advance Account Settings menu by tapping repeatedly on the Version string in the Settings. I filled in the base URL for my server (https://thor.heiselman.com) and enable the "Use Custom Account Service" option. Once I enable the option, I can see the client request the fxa-client-configuration file from my server successfully, however, it then attempts to load the login page on my server despite the configuration pointing all other services back to the public Firefox service.
m.m.[email protected]:
Can we bump the priority of this bug from a P3? Many people seem to be holding off moving to the FF ecosystem simply because they canāt carry their privately stored data without the additional cost of setting up an account server.
This clearly breaks the user experience and Iād have imagined that after a couple years of back and forth on Github this wouldāve received more attention.
Also mentioned in #3150 (which was closed in favor of the bug in the bugzilla system).
I was the submitter of the Bugzilla report. I am still willing to work with someone here to help resolve this.
This option (choose what Firefox Sync server to use) should definitely be available on iOS (as it appears to be available on Android). Looking forward to being able to set it up.
I recently made the switch to Firefox as my default browser (I think a lot of developer types have it installed, but drift back to their old setups for various comfort/muscle memory reasons). I would absolutely love to have the iOS version support a custom sync server.
There are quite a few "homelab" types that run significant infrastructure at home (i.e. VM hosts), and running something like a custom sync server doesn't add any extra overhead to their tech setup. I would absolutely run it, but it doesn't make any sense unless all of my Firefox devices can also use it.
When implemented, ensure URLs are https or localhost. This is a sec requirement from app services.
@garvankeeley if you look at my comment (copied from the original bug), all URLs are HTTPS with valid LE certs.
On desktop this is set in about:config using identity.fxaccounts.autoconfig.uri
Docs: https://moz-services-docs.readthedocs.io/en/latest/howtos/run-fxa.html
@garvankeeley this issue is specifically for Firefox on iOS which has no about:config
Is there a schedule available for this feature?
Many people seem to be holding off moving to the FF ecosystem simply because they canāt carry their privately stored data without the additional cost of setting up an account server.
This is exactly the reason why I don't use FF sync on any of my devices. Just because a self-hosted sync server it's not implemented on iOS :(
Same here @nook24. I already have the sync server setup for my Linux desktop. But I donāt use FF on my iPhone because of this. I would in a heartbeat though.
I have confirmed this works as-intended (by the Sync team), but the intention is that the entire stack is being hosted on the custom URL where the config file is.
Closing this bug as works as-intended, the docs here still apply as to how to use your own fxa and sync stack: https://moz-services-docs.readthedocs.io/en/latest/howtos/run-fxa.html
Iām very disappointed that we (the users) simply arenāt being heard. We know itās working as intended. We want how it works to change. I feel like plenty of people have laid out perfectly valid reasons for the behavior to change. And the lack of willingness to even acknowledge that this leaves iOS at a distinct disadvantage shows a poor attitude towards the Firefox community as a whole.
I stand by my offer to help test any changes if anyone is willing to actually listen and attempt to implement this feature request.
You are being heard. In fact, we were willing to spend a few hours today investigating this before concluding that this is not solely an iOS issue, but an FxA issue for something that is currently not supported. With limited resources, we have to prioritize issues and feature requests and the overall number of users who want this feature is almost immeasurably small.
You are also welcome to run your own full FxA/Sync stack and you can follow the steps outlined here to configure iOS to work with it: https://moz-services-docs.readthedocs.io/en/latest/howtos/run-fxa.html
I will be available to have a discussion around 2:00 pm US/Central and for most of the day after.
As for running a full stack server, it has been stated by several users that there are specific reasons for some of us to not want to do that.
This is a discussion to have with the FxA/Sync team, they implemented this feature in the product with the intention that it be consistent with Android behaviour. If more users make this request across the various products then I could see that changing their opinion.
Thanks for your time and investigation effort. I really appreciate this.
From the docs :
Note By default, a server set up using this guide will defer authentication to the Mozilla-hosted accounts server at https://accounts.firefox.com.
You can safely use the Mozilla-hosted Firefox Accounts server in combination with a self-hosted sync storage server. The authentication and encryption protocols are designed so that the account server does not know the userās plaintext password, and therefore cannot access their stored sync data.Alternatively, you can also Run your own Firefox Accounts Server to control all aspects of the system. The process for doing so is currently very experimental and not well documented.
I would say there should be a big fat warning, that the docs will not work for iOS devices.
I had given the /.well-known/fxa-client-configuration trick a shot but this didn't work. (As already expected).
This is a discussion to have with the FxA/Sync team, they implemented this feature in the product with the intention that it be consistent with Android behaviour.
I would really like to know why the option is not available on iOS. Is this an restriction from Apple or so?
I mean, it's available on Desktop and Android.
Again from the docs:
Since Firefox 33, Firefox for Android has supported custom sync servers. To configure Android Firefox 44 and later to talk to your new Sync server, just set the āidentity.sync.tokenserver.uriā exactly as above before signing in to Firefox Accounts and Sync on your Android device.
Are there just not enough iOS based Firefox users?
Please don't get me wrong. I don't want to blame anyone why this isn't implemented already. I'm just wondering why there is a different behavior.
I would say there should be a big fat warning, that the docs will not work for iOS devices.
I had given the/.well-known/fxa-client-configurationtrick a shot but this didn't work. (As already expected).
Can you indicate what part doesn't work specifically on iOS? If so, I can report this to the FxA/Sync team to investigate further.
The bug report here indicates that the content server is not on the same host as the /.well-known/fxa-client-configuration, which according to the server team, is not supported (which is correct behaviour for all platforms).
I would really like to know why the option is not available on iOS. Is this an restriction from Apple or so?
Firefox iOS should behave like Desktop and Android, if I can show that it isn't behaving consistently, I can get traction on getting something fixed.
Firefox on iOS doesn't have the ability to use about:config to configure the syncserver (token server) URL. Therefore, it already doesn't have feature parity with Android and desktop versions. This means that iOS users _cannot_ follow the same setup procedure as Android and desktop users.
iOS users only have the option to "Use Custom Account Service". This asks for a single URL at which it will retrieve the /.well-known/fxa-client-configuration. The structure of this file is a listing of the different components with URLs for each piece. The documentation indicates that one can set each value independently.
While Firefox on iOS does query and retrieve the fxa-client-configuration file, it doesn't obey it as far as the different URLs are listed. As stated earlier in this issue, I downloaded the file from the public Firefox Accounts service and changed only the URL for the token server and hosted that changed file on my own server (same one hosting the syncserver). The file contents are as follows:
{"auth_server_base_url":"https://api.accounts.firefox.com","oauth_server_base_url":"https://oauth.accounts.firefox.com","pairing_server_base_uri":"wss://channelserver.services.mozilla.com","profile_server_base_url":"https://profile.accounts.firefox.com","sync_tokenserver_base_url":"https://thor.heiselman.com/sync/token/1.0/sync/1.5"}
Firefox on iOS doesn't seem to use any of these other values and instead attend to authorize against the hosting server instead of any of the others listed here.
identity.sync.tokenserver.uri to https://sync.nook24.eu/token/1.0/sync/1.5 using about:configiOS Setup:
https://sync.nook24.eu and enable "Use custom Account Service"
xxx.xxx.xxx.xxx - - [13/Jun/2019:21:26:39 +0200] "GET /.well-known/fxa-client-configuration HTTP/1.1" 304 5373 "-" "Client/15323 CFNetwork/976 Darwin/18.2.0"
xxx.xxx.xxx.xxx - - [13/Jun/2019:21:27:37 +0200] "GET /signin?service=sync&context=fx_ios_v1 HTTP/1.1" 404 5542 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 12_1_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/17.3b15323 Mobile/16D57 Safari/605.1.15"
@vbudhram do you mind looking at the last comment, the user was able to avoid hosting the content server when setting identity.sync.tokenserver.uri on Desktop, but this appears unavoidable on iOS. Should iOS not behave the same?
These are the exact instructions I followed as well.
Ok, after talking with some more FxA folks, it seems that you are correct and this should be supportable as long as we add a new pref on iOS explicitly for identity.sync.tokenserver.uri. I'll update the title to add clarity here so that this work can get scheduled.
Sounds good! Looking forward to get this.
Many thanks to all of you.
Thank you justindarc. This looks like it will work great for us!
No problem. Sorry for the confusion.
WIP pull request: https://github.com/mozilla-mobile/firefox-ios/pull/5158
I got the update on iOS today, thanks to all involved for making this happen!
Is it working for everybody as expected?
All I'm seeing is a GET /mozilla/token/1.0/sync/1.5 HTTP/2.0" 200 893.
Nothing for /storage/, no actual syncing.
Edit: it's 100% working on lighttpd! Thanks again to everybody!
Installed the iOS update an hour ago and everything is working as expected. Set the token server, restarted Firefox and logged in to my Firefox account. Syncing is also working in both directions.
@fireglow My sync server is running under http (at least for now), maybe this makes a difference.
Thanks to all involved for making this happen!
Works like expected for me, many thanks to all.
This is my setup: https://daniel-ziegler.com/computer/netzwerk/linux/2019/07/07/Firefox-Sync-iOS/
Doesn't work for me :(
I use the docker ffsync image and a reverse-proxy.
I add my server : https://mydomain/token/1.0/sync/1.5
I finally got the chance to test this out and am running into a problem.
I'm running the syncserver from Docker Hub (same as I always have). Firefox on my iPhone is able to set the token server, I'm able to login, and I see the request make it to the sync server. The device is added to my (Mozilla hosted) Firefox Account and my desktop browser pops up a notification saying that the iPhone was added to my account. I am able to send pages back and forth between my two browsers. However, my bookmarks, history, open tabs, and logins/passwords are not syncing.
All of the requests to my sync server are resulting in HTTP 200 status codes and I was using this sync server with my Android phone, so I think everything is setup properly there, but I'd be happy to do some testing/logging if someone points me in a direction.
Same for me @jheiselman , thank for your post, i'm not english : it's hard for me to explain !
I use Docker Hub too and it's doesn't work.
Same issue here. Logs give 200:
10.8.0.1 - - [14/Jul/2019:20:59:32 +0000] "GET /token/1.0/sync/1.5 HTTP/2.0" 200 513 "-" "Firefox-iOS-FxA/18.0b15690 (iPhone; iPhone OS 12.3.1) (Firefox)" 22306 "Host-firesync-bb8-fun-0" "http://172.22.0.22:5000" 4ms
10.8.0.1 - - [14/Jul/2019:20:59:45 +0000] "GET /token/1.0/sync/1.5 HTTP/2.0" 200 513 "-" "Firefox-iOS-FxA/18.0b15690 (iPhone; iPhone OS 12.3.1) (Firefox)" 22325 "Host-firesync-bb8-fun-0" "http://172.22.0.22:5000" 2ms
10.8.0.1 - - [14/Jul/2019:21:00:00 +0000] "GET /token/1.0/sync/1.5 HTTP/2.0" 200 513 "-" "Firefox-iOS-FxA/18.0b15690 (iPhone; iPhone OS 12.3.1) (Firefox)" 22339 "Host-firesync-bb8-fun-0" "http://172.22.0.22:5000" 2ms
10.8.0.1 - - [14/Jul/2019:21:00:03 +0000] "GET /token/1.0/sync/1.5 HTTP/2.0" 200 513 "-" "Firefox-iOS-FxA/18.0b15690 (iPhone; iPhone OS 12.3.1) (Firefox)" 22340 "Host-firesync-bb8-fun-0" "http://172.22.0.22:5000" 2ms
10.8.0.1 - - [14/Jul/2019:21:00:37 +0000] "GET /token/1.0/sync/1.5 HTTP/2.0" 200 513 "-" "Firefox-iOS-FxA/18.0b15690 (iPhone; iPhone OS 12.3.1) (Firefox)" 22360 "Host-firesync-bb8-fun-0" "http://172.22.0.22:5000" 2ms
10.8.0.1 - - [14/Jul/2019:21:00:40 +0000] "GET /token/1.0/sync/1.5 HTTP/2.0" 200 513 "-" "Firefox-iOS-FxA/18.0b15690 (iPhone; iPhone OS 12.3.1) (Firefox)" 22364 "Host-firesync-bb8-fun-0" "http://172.22.0.22:5000" 2ms
"Send tab to device" feature works sometimes (with a lot of lag and Firefox restarts). Bookmarks and other content sync doesn't work at all.
Running the latest mozilla/syncserver image (3f9bc839727f)
@jheiselmann:
Same problem for me.
All other devices (PC, Android) are able to sync. I also see my iOS device on my Firefox devices list.
But the iOS device cannot sync any bookmark or "synced tabs". I can't even send a tab from another device to the iPad, because the iPad doesn't appear on the shown list. (Again: my iPad appears on the devices list on my profile!)
Question for those that cannot get sync going:
Are you using nginx?
I tried and failed with nginx, had to set up a lighttpd on a dedicated port and switch every device, iOS or not, over to that port. Only then sync worked in iOS.
Yes, nginx. But no chance to change the proxy! Is it missing some headers?
All other devices (PC, Android, Mac) are able to sync without any problems.
@fireglow I am not using nginx. I am using Caddy HTTP server.
Further, for those of us who canāt get it to work, it seems to be the same in that each of us can use it from a PC and Android. Itās only iOS based devices that donāt work. So, I donāt think there is something wrong in the web server setup.
It has to be something, it'll be interesting to know what server people are having success with, and which servers are failing.
I'm having success with lighttpd with
$SERVER["socket"] == "10.0.112.1:8888" {
ssl.engine = "enable"
ssl.pemfile = "/usr/local/etc/ssl/acme/foo.bar/cert.pem"
ssl.privkey = "/usr/local/etc/ssl/acme/foo.bar/key.pem"
$HTTP["host"] == "sync.foo.bar" {
ssl.pemfile = "/usr/local/etc/ssl/acme/sync.foo.bar/cert.pem"
ssl.privkey = "/usr/local/etc/ssl/acme/sync.foo.bar/key.pem"
proxy.server = ( "" =>
( (
"host" => "jail_mozillasync",
"port" => 5000
) )
)
proxy.forwarded = ( "for" => 1,
"proto" => 1,
"host" => 1,
)
}
}
Hmm. Well, I can try swapping out the web layer this evening to see if that makes a difference for me. If it works, then I can see about putting wireshark on it to check out the headers.
I'm running Traefik in front of the syncserver to terminate TLS, it does forward all 3 X-Forwarded headers.
Config: https://github.com/captn3m0/nebula/blob/master/firefox-sync.tf#L18-L24
@fireglow I finally got around to trying lighttpd and it still isn't working for me. However, I did see that you had your sync server setup as the root application at a dedicated domain. I had mine mounted under a /sync context root. So I changed it up and created a dedicated DNS name and mapped it the same way that you had (full proxy from / to the sync server) and it still hasn't worked.
Symptoms as described before:
@Mardiie I am not running the account server. My setup is using the Mozilla-hosted FxA while using a self-hosted sync server.
For the record, Iām having the same issue. Login works but nothing syncs. Iām using Traefik in front of syncserver too with letās encrypt.
Same problem here. Is it about some configuration of the sync server (e.g. that we have to use FORCE_WSGI_ENVIRON and the seen url does not match the configured application url? Or is it some missing header on the reverse proxy? I use Caddy as a reverse proxy, use LE certificates and forward all the necessary X-Forwarded- headers.
However I have the same problems, send tab to device works but sync is not started, no request to the /storage endpoints are being made. From my Mac it works perfectly.
Figured it out! HTTP/2.0 seems to be the problem. After forcing http 1.1 in caddy using:
tls {
alpn http/1.1
}
everything works just fine!
I assume this is also the reason why it does not work with nginx as a reverse proxy while it does with lighttpd (where HTTP/2.0 is not turned on). Hope this helps.
@dprandzioch
That would make a lot of sense. Unfortunatly I can't test this as in nginx one can't disable http2 per vhost.
But that would mean that something in firefox-ios is broken to not accept http2, but also don't do a http1.1 request.
Unfortunately it is working for me to sync with an ios device. My desktop FF on MacOS and Windows works fine. I can even sync with Waterfox. I'm using docker image from crazy-max https://github.com/crazy-max/docker-firefox-syncserver on a Synology NAS and Reverse proxy of Synology NAS setup properly with http proxy version set to 1.1 but it still wouldn't sync.

Any ideas? Has someone solved this problem yet with ios not syncing?
yes, works also for me, when disabling HTTP2 !
I wasn't able to get this working just yet. I have the server offering only http/1.1 when the SNI is set to my hostname, and when I use curl to check it, I can see that http/1.1 is being accepted, but the sync still doesn't work.
Using caddy 2.
So, besides all the related server configurations, where in the iOS app do you actually set the location of the sync server? about:config on the latest iOS build still brings up an empty page for me and I don't see any settings on the sync setting page in the app.
@mmnaseri scroll down and tap the Version line a handful of times. After a few (five?) taps, more menu items will appear including Advanced up under Sign In. In there, you can set a custom sync server or a custom token server.
@mmnaseri scroll down and tap the Version line a handful of times. After a few (five?) taps, more menu items will appear including Advanced up under Sign In. In there, you can set a custom sync server or a custom token server.
Have tried that but still doesn't sync. I'm using FF syncserver from https://github.com/crazy-max/docker-firefox-syncserver on a Synology NAS and Reverse proxy of Synology NAS setup properly with http proxy version set to 1.1
Do you think it is related to a specific version of firefox synserver?
same here, please fix
running crazy-max docker all is fine beside Firefox for iOS does not sync bookmarks etc.
Sending a tab works
using Firefox so is not an option for Apple Safari
Same here. Firefox syncs with my private server across Mac, Windows and Android devices but iOS won't work. Using latest version 20.2 (16690)
Can anyone confirm that HTTP/2 seems to be the fault? I can't disable HTTP/2 for a specific host (using traefik), but I see that the requests made are HTTP/2, so it's strange that it only expects HTTP/1.1 as the response.
@mavidser yes, in my case it fixed the problem by disabling HTTP2.
Yes, this solved my issue as well. Forcing the connection to HTTP 1.1 fixed it.
Iām not sure Iād agree that youāre compromising security. HTTP/2 is more about efficiency. If you secure your server with a certificate, then itās still encrypted communication. Besides, you can still accept HTTP/2 over the internet and terminate and use HTTP/1.1 just between the front end proxy and the syncserver.
That said, I agree that this is a workaround at best, not a solution.
Just to chime in a little:
Python 2.7, the flavor of Python the sync software is written in, will go End-of-Life at the end of this month, year, and decade.
Mozilla already has indicated that there will be no rewrite for Python 3.
I gather there's a rewrite of these services in Rust in the works, at https://github.com/mozilla-services/syncstorage-rs
It's as of now unclear to me how all these parts will fit together in a way so us self-hosters will be able migrate over.
Fire glow, good point! I hadnāt considered if there was a rewrite in the works. Hopefully the rust version is released soonish.
Besides, you can still accept HTTP/2 over the internet and terminate and use HTTP/1.1 just between the front end proxy and the syncserver.
@jheiselman I was under the impression that since it's only the iOS client which has this issue, HTTP 1.1 is needed on the internet, and doesn't matter on the syncserver. If that's the case, the client problems might still persist with the rust server too.
Seeing the same issue here; login works and I can see the server being hit but nothing comes across. The same sync server works without issues on Android, desktop Linux and macOS.
Firefox iOS v20.2, iOS v12.4.4, sync server v1.8.0, nginx v1.10.3.
Sync log from iPad upon attempt to sync:
iPad-sync-failure-sync.20191212T102735+0100.log
Maybe this warrants a separate issue?
There is now a regression after FF 25 (as reported in #6535) that has broken this workflow, and as such, this feature is not usable on iOS anymore. Not being able to access history/bookmarks on my primary mobile device is a deal breaker for most users.
Any chances to get this fixed?
Setup
I have a similar setup as described before. I am self-hosting the sync server Mozilla docker image from here on a synology nas. The reverse proxy is configured without http2 support and uses https protocol with hsts.
Issue
Invalid OAuth parameter: redirect_url with Firfox IOS App 27.0 (18428) when trying to connect to the custom sync server
Any chances to get this fixed?
Setup
I have a similar setup as described before. I am self-hosting the sync server Mozilla docker image from here on a synology nas. The reverse proxy is configured without http2 support and uses https protocol with hsts.Issue
Invalid OAuth parameter: redirect_url with Firfox IOS App 27.0 (18428) when trying to connect to the custom sync server
i can second that. same behaviour here.
Same here. When trying to activate sync after i set a custom sync server, i get two choices:
1> when i go to stable.dev.lcip.org/pair, i always get a message like 'are you using your system camera? Then you have to connect out of a Firefox App', and no QR Code is showing up. Also the URL bar changes to 'https://stable.dev.lcip.org/pair/unsupported'.
2> Using the Email Button gives Invalid OAuth parameter: redirect_url
same here
Same problem as described by @delacroix0815 above with Firefox/iOS 27.0 (18428) running on iPadOS 13.6.
Still the same problem on Synology Nas with this image https://github.com/crazy-max/docker-firefox-syncserver
Same here ...
This issue should be reopened since the feature appears to have been removed on latest versions (not sure when it was actually removed).
Itās not removed, it just doesnāt work. You can still enable the developer settings by tapping repeatedly on the version. Thereās still a spot for a Custom Sync Token Server under Advanced Sync Settings. And it seems to actually connect. It just doesnāt sync bookmarks or tabs anymore. The āSend to deviceā works. Thatās pretty much it.
I feel like this feature is just abandoned which is too bad. I may as well switch back to Safari.
Itās not removed, it just doesnāt work. You can still enable the developer settings by tapping repeatedly on the version. Thereās still a spot for a Custom Sync Token Server under Advanced Sync Settings. And it seems to actually connect. It just doesnāt sync bookmarks or tabs anymore. The āSend to deviceā works. Thatās pretty much it.
I feel like this feature is just abandoned which is too bad. I may as well switch back to Safari.
I cannot seem to find the Advanced Sync Settings within the debug mode anymore. That is why I believed the feature was actually removed. Where is this settings button hidden?
Settings -> Tap Version row under About heading near the bottom. After some number of taps (10?) the debug menus show up at the bottom. Back near the top will be the Advanced Sync Server settings. Note that it will only show up if you are not currently signed in to Sync.
@jheiselman This feature is completly broken, given we cannot link a device to a custom sync server anymore (see #6535). What's the point of being able to configure a custom server if you cannot connect to it ?
@Thlb I agree completely. I was just stating that it wasn't removed; just broken. It's been broken for quite some time now and no one seems to be paying any attention to this issue since it was closed. I suppose one should re-open it, but I feel like this isn't something that the Mozilla iOS team cares much about given how it took quite a bit of back and forth to even get someone to add the feature and then it was immediately broken after the next update.
Reopen, still broken ..
Time for change ..
For all following this issue or find it through web search: @drixter figured out how to restore the custom sync server feature on current iOS versions of Firefox.
Original post: https://github.com/mozilla-mobile/firefox-ios/issues/6535#issuecomment-687747921
Summary: https://github.com/mozilla-mobile/firefox-ios/issues/6535#issuecomment-687751723
Most helpful comment
WIP pull request: https://github.com/mozilla-mobile/firefox-ios/pull/5158