Can't log into Google

[Peeja]

Type: ruleset/website issue

With HTTPS Everywhere enabled, I'm no longer able to log into Google. After entering my password, I see the error "Sorry, something went wrong there. Try again." It appears that a POST request to https://accounts.google.com/_/signin/challenge?[query redacted in case it's sensitive] comes back 401. With HTTPS Everywhere disabled, that request is 200, and the login works. Notably, for some reason, after seeing the error once and disabling HTTPS Everywhere, I have to clear my cookies for the google.com domain before logging in will work again.

[Eric-Dunaway]

I am having the same issue

With HTTPS Everywhere enabled I get a Sorry, something went wrong there. Try again.
With it disabled I am presented with my Multi-Factor Authentication prompt and can complete the login

Note: I tried disabling HTTPS Everywhere for https://accounts.google.com but still had an issue

[pipboy96]

@zoracon I suspect that the culprit is a securecookie tag. Can you confirm that is the case?

[zoracon]

@zoracon I suspect that the culprit is a securecookie tag. Can you confirm that is the case?

I am not able to duplicate this issue since I seem to be able to log into multiple accounts with the extension without issue. I need a little more information here though.

@Peeja and @Eric-Dunaway can you both list the browser, browser version, and operating system you are using when you come across this error?

[Peeja]

@zoracon Sure thing: Chrome 87.0.4280.88, macOS 10.15.7

[hthief]

I've had the same happen, along with various 400s over cookies sizes that seem related to the plugin.
On this particular google issue I only had it happening on my mac os, 10.14.6 chrome version 87.0.4280.141, but the cookie one happens on win10 as well.

[alebelcor]

Hi, this is happening for me as well.

At first I thought it was a Google-related issue. Only way I found to fix it was to delete all cookies and restart my logins.

Then, for some random act of the universe, I decided to actually look at the cookies before trying to log in. I noticed a lot of cookies prefixed with amp_cookie_test and thought it was weird. So I deleted them before attempting a Google login, and it worked.

I've been having to do that ever since, and it works every single time.

Today I got an HTTP 400 on a different (non-Google) site though, but the error on screen stated that the "HTTP headers size exceeded the expected amount" (or similar). The site was working completely fine one minute, and failed to load the next. I, again, tried the trick of deleting those cookies. And it started loading again.

I finally did an online search and found a GitHub issue where something of the sort is mentioned, and then I read this comment (thanks @humaknlght).

After some tests I can say with 99.99% certainty that the HTTPS Everywhere (Chrome) extension is causing those amp_cookie_test cookies to show up somehow.

Manually deleting those cookies already fixed the login problems for me. And disabling the extension should prevent them for ever showing up again.

And now that I think about it, the cryptic Google error that shows up when the login fails may had been the same "headers being too big" type of error I saw on the other site.

Not sure if this is a bug or what, but wanted to let anyone else know that may be experiencing this (frustrating) problem.

tl;dr If your Google login fails: Disable the HTTPS Everywhere extension, and delete any cookies prefixed with amp_cookie_test before retrying to log in

[zoracon]

Amending the rule that impacts this. I can do a ruleset release as soon as possible once it is up to see if it took care of this issue.

[zoracon]

Ruleset version: 2021.2.4 is out. If any of you don't mind testing I'd appreciate it to see if the issue is fixed.

[alebelcor]

I'm afraid I continue to see the same behavior.

That is, amp_cookie_test[hash] cookies being created on the .google.com domain when I enable the extension and reload Gmail. If I disable the extension those cookies are not created.

Would it be possible some middle layer is using Amplitude? It seems that may the source of that, and they have an open issue about it.

[zoracon]

We wouldn't be able to control whether or not an analytics library is creating cookies that interfere with the login process on a Google account. I am failing to see these cookies generated with a clean install of Chrome and HTTPS Everywhere running, logging into a Google account.

HTTPS Everywhere does not create any cookies, but it does attempt to secure the cookies for a particular domain if specified in the rule. I removed the rule to do this for accounts.google.com. I will take a look again at the rule to see if any other part of it could be interfering. But any cookies generated outside of the extension is not within the scope that we can address.

[zoracon]

Closing since we have removed the cookie rule for account.google.com.

[hansottowirtz]

I recently noticed that amp_cookie_test_ cookies are breaking these sites for me:

• Gmail (cookies on https://mail.google.com) (obscure error)
• LinkedIn (https://www.linkedin.com) (obscure error)
• Google Maps (https://www.google.com) (tiles not loading)

Manually removing those cookies solves the problem. I do not have an ad blocker installed, only HTTPS Everywhere.