WIP: Try to fix #3581, make Screenshots work with third party cookies…

… disabled

This adds a second attempt to login to wantsauth logins, one that runs in sitehelper.js, and tries to get the cookie set on a request that appears to come from the content page itself.

Unfortunately this doesn't work, as the XMLHttpRequest acts like it comes from a moz-extension URL and not the page, so it's still treated as a third party cookie.

addon/webextension/background/auth.js

@@ -200,12 +200,19 @@ this.auth = (function() {
 
   communication.register("getAuthInfo", (sender, ownershipCheck) => {
     return registrationInfoFetched.then(() => {
+      return exports.authHeaders();
+    }).then((authHeaders) => {
       let info = registrationInfo;
       if (info.registered) {
         return login({ownershipCheck}).then((result) => {
-          return {isOwner: result && result.isOwner, deviceId: registrationInfo.deviceId};
+          return {
+            isOwner: result && result.isOwner,
+            deviceId: registrationInfo.deviceId,
+            authHeaders
+          };
         });
       }
+      info = Object.assign({authHeaders}, info);
       return info;
     });
   });

addon/webextension/sitehelper.js

@@ -20,13 +20,38 @@ this.sitehelper = (function() {
     document.dispatchEvent(new CustomEvent(name, {detail}));
   }
 
+  /** Set the cookie, even if third-party cookies are disabled in this browser
+      (when they are disabled, login from the background page won't set cookies) */
+  function sendBackupCookieRequest(authHeaders) {
+    // We want this to be sent as though it is sent by the page, which will make
+    // the cookie NOT a third party cookie:
+    let MyXMLHttpRequest = document.defaultView.XMLHttpRequest;
+    // FIXME: seems impossible to get an XMLHttpRequest that acts as though the
+    // content page is what made the request
+    console.log("using xmlhttprequest:", MyXMLHttpRequest, XMLHttpRequest === MyXMLHttpRequest);
+    let req = new MyXMLHttpRequest();
+    req.open("POST", "/api/set-login-cookie");
+    for (let name in authHeaders) {
+      req.setRequestHeader(name, authHeaders[name]);
+    }
+    req.send("");
+    req.onload = () => {
+      if (req.status != 200) {
+        console.warn("Attempt to set Screenshots cookie via /api/set-login-cookie failed:", req.status, req.statusText, req.responseText);
+      } else {
+        console.log("Got a good response from setting cookie");
+      }
+    };
+  }
+
   document.addEventListener("delete-everything", catcher.watchFunction((event) => {
     // FIXME: reset some data in the add-on
   }, false));
 
   document.addEventListener("request-login", catcher.watchFunction((event) => {
     let shotId = event.detail;
     catcher.watchPromise(callBackground("getAuthInfo", shotId || null).then((info) => {
+      sendBackupCookieRequest(info.authHeaders);
       sendCustomEvent("login-successful", {deviceId: info.deviceId, isOwner: info.isOwner});
     }));
   }));

server/src/middleware/csrf.js

@@ -26,7 +26,8 @@ function isCsrfExemptPath(path) {
   return isAuthPath(path)
     || path.startsWith("/data")
     || path === "/event"
-    || path === "/error";
+    || path === "/error"
+    || path === "/api/set-login-cookie";
 }
 
 function csrfHeadersValid(req) {

server/src/server.js

@@ -587,6 +587,19 @@ app.post("/api/login", function(req, res) {
   });
 });
 
+app.post("/api/set-login-cookie", function(req, res) {
+  if (!req.deviceId) {
+    sendRavenMessage(req, "Attempt to set login cookie without authentication");
+    simpleResponse(res, "Not logged in", 401);
+    return;
+  }
+  sendAuthInfo(req, res, {
+    deviceId: req.deviceId,
+    accountId: req.accountId,
+    userAbTests: req.abTests
+  });
+});
+
 app.put("/data/:id/:domain", upload.single('blob'), function(req, res) {
   let slowResponse = config.testing.slowResponse;
   let failSometimes = config.testing.failSometimes;