Netlify-cms: [Firefox] Unable to login to github from admin when "privacy.firstparty.isolate" flag is true

[borisschapira]

- Do you want to request a feature or report a bug?

This is a undocumented behavior.

- What is the current behavior?

When using Firefox with the "privacy.firstparty.isolate" flag set to true (in about:config), I'm unable to login.

- If the current behavior is a bug, please provide the steps to reproduce.

• Open Firefox
• Go to "about:config" in the address bar. Change the value of the key "privacy.firstparty.isolate" to true.
• Go to your Netlify CMS back-end (for example: http(s)://yourdomain.com/admin)
• Click on "Login"

A pop-up will open, asking for authorization. After authorization is complete, the pop-up won't close by itself nor you access the back-end on the main frame.

- What is the expected behavior?

It is kinda expeted behavior but perhaps it needs to be detected to warn the user.

- Please mention your CMS, node.js, and operating system version.

Netlify CMS version 1.0.3

- Please link or paste your config.yml below if applicable.

No need.

[talves]

I wonder if this is the case when using the git-gateway. @borisschapira were you using git-gateway or github for the backend.name in the config.yml?

[borisschapira]

@talves Github (project: https://github.com/DaughtersOfCharity/oasis/)

[tech4him1]

@borisschapira Can you check for errors in your browser console,on both the CMS window and the authentication popup?

[borisschapira]

My Firefox is in french, so I've got in the main window:

Impossible d’exécuter « postMessage » sur « DOMWindow » : l’origine cible fournie (« https://api.netlify.com ») ne correspond pas à l’origine de la fenêtre du destinataire (« https://api.netlify.com »).

which roughly translates to:

Unable to execute "postMessage" on "DOMWindow": the provided target origin ("https://api.netlify.com") does not match the origin of the recipient window ("https://api.netlify.com").

[borisschapira]

As this is an experimental features, I wouldn't spend more time on it. If someone comes back with the same kind of problem, you'll be aware.

[tech4him1]

@borisschapira Yes, agreed, thank you for reporting!

Taking a quick look at the docs on that experimental setting, I'm guessing you should be able to fix this by also setting privacy.firstparty.isolate.restrict_opener_access to false in your FireFox config.

[arthurdouillard]

Hello

I have the same problem: I can't even log in to https://app.netlify.com/. I'm redirected on a page saying "Authorized", but there is no further redirection to the actual https://app.netlify.com/. And re-entering this url force me to re-log in.

This problem is happening with Firefox Quantum while Chrome has no problem.

Both:

privacy.firstparty.isolate

And:

privacy.firstparty.isolate.restrict_opener_access

Were set to false but it doesn't solve anything. Any thoughts ?

Thanks,

[erquhart]

@Mougatine try clearing all local data for that domain - cookies, localstorage, indexeddb, etc

[erquhart]

Also, since your issue isn't happening only when the flag is set to true, it's probably unrelated. Going to close this since it applies to an experimental browser feature, but please open a separate issue or reach out in Gitter if the problem persists.