Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

Fix Cross-Origin Read Blocking (CORB) for extensions #14841

Closed
srirambv opened this issue Jul 25, 2018 · 12 comments
Closed

Fix Cross-Origin Read Blocking (CORB) for extensions #14841

srirambv opened this issue Jul 25, 2018 · 12 comments
Assignees
@darkdh
Labels
0.23.x issue first seen in 0.23.x bug cr68 feature/extensions/LastPass feature/extensions QA/checked-Linux QA/checked-macOS QA/checked-Win64 QA/test-plan-specified release/blocking release-notes/include
Milestone
0.23.x Hotfix 3 (...

Comments

@srirambv
Copy link
Collaborator

srirambv commented Jul 25, 2018 •
edited by bsclifton
Loading

Description

Lastpass login page not shown on clean profile

Test plan / Steps to Reproduce

  1. Install 0.23.72
  2. Enable Lastpass from extension
  3. Click on extension icon, shows Internet error unable to connect
  4. Close extension popup, console logs error
  1. Click extension popup again shows load spinner but nothing opens

Actual result:
image
image
image

Expected result:
Extension should load

Reproduces how often:
100% on new profile
Reproduced on mac by @LaurenWags

Brave Version

about:brave info:

Brave|
--|--0.23.72
V8|6.8.275.24
rev|c3b1cac
Muon|8.0.2
OS Release|10.0.17134
Update Channel|Release
OS Architecture|x64
OS Platform|Microsoft Windows
Node.js|7.9.0
Brave Sync|v1.4.2
libchromiumcontent|68.0.3440.75

Reproducible on current live release:
No

Additional Information

When lastpass is enabled on Beta and then enabled on release channel it shows correct login popup page. Issue happens only when trying on release channel
image
@bsclifton
Copy link
Member

Per @darkdh

https://developer.chrome.com/extensions/tabs#method-getAllInWindow
the API has been deprecated

@jonathansampson has updated the LastPass extension to 4.15.2.5 which should resolve the issue 😄 👍 It may take a while for the change to get picked up on existing installs. Please re-open if you're not seeing the new version 😄

@darkdh
Copy link
Member

darkdh commented Jul 25, 2018

No, the API issue has been there for a long time and it is a easy fix.
However, the real problem is some changes related to CrossOriginReadBlocking that causes

newserver.js:1 
Cross-Origin Read Blocking (CORB) blocked cross-origin response https://lastpass.com/lmiapi/login/type?username= with MIME type application/json. See https://www.chromestatus.com/feature/5629709824032768 for more details.

@darkdh darkdh reopened this Jul 25, 2018
@darkdh darkdh self-assigned this Jul 25, 2018
darkdh added a commit to brave/muon that referenced this issue Jul 26, 2018
@darkdh
Implement GetInitatorSchemeBypassingDocumentBlocking to avoid CORB
3c654ff 
checking on extensions from CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders

fix brave/browser-laptop#14841

Auditors: @bridiver, @bbondy
@darkdh
Copy link
Member

darkdh commented Jul 26, 2018

CORB error fixed by brave/muon@3c654ff
API error fixed by brave/muon@4cd780d

will be available in muon 8.0.3

@darkdh darkdh closed this as completed Jul 26, 2018
@kjozwiak kjozwiak added the cr68 label Jul 27, 2018
This was referenced Jul 27, 2018
Closed
Closed
Closed
@btlechowski
Copy link
Contributor

btlechowski commented Jul 27, 2018 •
edited by kjozwiak
Loading

Verified on Ubuntu 17.10 x64

  • 0.23.73 50bdb6d
  • Muon 8.0.3
  • libchromiumcontent 68.0.3440.75

Verified on Windows x64 with

  • 0.23.73 50bdb6d
  • Muon 8.0.3
  • libchromiumcontent 68.0.3440.75

@LaurenWags LaurenWags mentioned this issue Aug 24, 2018
Closed
darkdh added a commit to brave/muon that referenced this issue Aug 28, 2018
@darkdh
Implement GetInitatorSchemeBypassingDocumentBlocking to avoid CORB
0ca0bee 
checking on extensions from CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders

fix brave/browser-laptop#14841

Auditors: @bridiver, @bbondy
@bsclifton bsclifton reopened this Aug 28, 2018
@bsclifton
Copy link
Member

Re-opening as issue may have been re-introduced. @darkdh can address this soon with a new Muon

@darkdh
Copy link
Member

darkdh commented Aug 28, 2018

screen shot 2018-08-28 at 12 14 22

These two commits were left over when merging C68 into master

darkdh added a commit to brave/muon that referenced this issue Aug 29, 2018
@darkdh
Implement GetInitatorSchemeBypassingDocumentBlocking to avoid CORB
2f4d786 
checking on extensions from CrossSiteDocumentResourceHandler::ShouldBlockBasedOnHeaders

fix brave/browser-laptop#14841

Auditors: @bridiver, @bbondy
@kjozwiak kjozwiak mentioned this issue Aug 29, 2018
Closed
@kjozwiak
Copy link
Member

kjozwiak commented Aug 29, 2018 •
edited
Loading

Received several +1's from the community:

@kjozwiak kjozwiak mentioned this issue Aug 29, 2018
Closed
@darkdh
Copy link
Member

darkdh commented Aug 29, 2018

fixed in muon 8.0.9

@darkdh darkdh closed this as completed Aug 29, 2018
This was referenced Aug 29, 2018
Closed
Closed
Closed
@srirambv
Copy link
Collaborator Author

srirambv commented Aug 29, 2018 •
edited by btlechowski
Loading

Verified on Windows 10 x64 using

  • 0.23.105 9a46f8f
  • Muon 8.0.9
  • libchromiumcontent 68.0.3440.84
  • Verified no errors when opening the extension popup
  • Verified able to login to Lastpass account
  • Verified able to autofill credential details
  • Verified background page doesn't throw any error when using the password manager to autofill

Passed with macOS 10.12.6 using

  • 0.23.105 9a46f8f
  • Muon 8.0.9
  • libchromiumcontent 68.0.3440.84
  • verified STR
  • Verified no errors when opening the extension popup
  • Verified able to login to Lastpass account
  • Verified able to autofill credential details
  • Verified background page doesn't throw any error when using the password manager to autofill

PASSed on Ubuntu 17.10 x64

  • 0.23.105 9a46f8f
  • Muon 8.0.9
  • libchromiumcontent 68.0.3440.84

@bsclifton bsclifton mentioned this issue Aug 29, 2018
Closed
@stellar6
Copy link

FIXED: tested on Win 10 x64

Brave: 0.23.105
V8: 6.8.275.24
rev: 9a46f8f
Muon: 8.0.9

Verified no errors when opening the extension popup
Verified able to login to Lastpass account

@kjozwiak
Copy link
Member

@stellar6 thanks for double checking! Really appreciate it! 👍

@kjozwiak kjozwiak changed the title Lastpass login page not shown on clean profile Fix Cross-Origin Read Blocking (CORB) for extensions Aug 30, 2018
@kjozwiak kjozwiak mentioned this issue Aug 30, 2018
Closed
@NumDeP
Copy link

NumDeP commented Aug 30, 2018 •
edited
Loading

@kjozwiak this was posted an hour ago mentioning an issue still persists with generating and fill and add new pass on MacOS - https://community.brave.com/t/lastpass-still-not-working/31111

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@darkdh darkdh

Labels
0.23.x issue first seen in 0.23.x bug cr68 feature/extensions/LastPass feature/extensions QA/checked-Linux QA/checked-macOS QA/checked-Win64 QA/test-plan-specified release/blocking release-notes/include
Projects
None yet
Milestone
0.23.x Hotfix 3 (Release Channel)
Development

No branches or pull requests
9 participants
@kjozwiak @bsclifton @darkdh @srirambv @LaurenWags @NumDeP @btlechowski @GeetaSarvadnya @stellar6