Bug 8014

Summary:	Web Access login crashes if cookies are disabled
Product:	ThinLinc	Reporter:	Samuel Mannehed <samuel>
Component:	Web Access	Assignee:	Bugzilla mail exporter <bugzilla-qa>
Status:	NEW ---
Severity:	Normal	CC:	adaha
Priority:	P2	Keywords:	upstream
Version:	trunk
Target Milestone:	LowPrio
Hardware:	PC
OS:	Unknown
See Also:	https://bugzilla.cendio.com/show_bug.cgi?id=8015 https://bugzilla.cendio.com/show_bug.cgi?id=8191 https://bugzilla.cendio.com/show_bug.cgi?id=8484
Acceptance Criteria:
Attachments:	Screenshot showing the JavaScript crash in Microsoft Edge Screenshot showing the JavaScript crash in Safari

Description Samuel Mannehed cendio

2022-10-26 15:52:31 CEST

Created attachment 1071 [details]
Screenshot showing the JavaScript crash in Microsoft Edge

Users might disable cookies in their browser. Doing so will cause Web Access to crash during login, showing a scary JavaScript error.

These settings are presented in different ways in different browsers:

* In Chrome the setting is called "Block all cookies (not recommended)" under "Cookies and other site data". It's disabled by default.
* In Firefox the setting is under "Enhanced Tracking Protection" when choosing "Custom". The issue only appears when "All Cookies (will cause websites to break)" is selected. It's default value is "Cross-site tracking cookies, and isolate other cross-site cookies".
* In Edge the setting is called "Allow sites to save and read cookie data (recommended)". It's enabled by default.
* In Safari on iPadOS 16.1, the setting is called "Block All Cookies", it's found under "Privacy & Security". It's disabled by default.

In Edge & Chrome the error says:

> ThinLinc Web Access encountered an error:
> 
> Failed to read the 'localStorage' property from 'Window': Access is denied for this document.
> 
>    Error: Failed to read the 'localStorage' property from 'Window': Access is denied for this document.
>        at Module.readSetting (https://samuel.lkpg.cendio.se:300/app/webutil.js:159:9)
>        at Object.start (https://samuel.lkpg.cendio.se:300/app/ui.js:95:21)
>        at https://samuel.lkpg.cendio.se:300/app/ui.js:49:27

In Firefox the error says:

> ThinLinc Web Access encountered an error:
> 
> The operation is insecure.
> 
> https://samuel.lkpg.cendio.se:300/app/webutil.js
> 
>    readSetting@https://samuel.lkpg.cendio.se:300/app/webutil.js:159:9
>    start@https://samuel.lkpg.cendio.se:300/app/ui.js:95:21
>    prime/<@https://samuel.lkpg.cendio.se:300/app/ui.js:49:27

In Safari the error says:

> ThinLinc Web Access encountered an error:
> 
> The operation is insecure.
> 
>    readSetting@https://samuel.lkpg.cendio.se:300/app/webutil.js:159:29
>    start@https://samuel.lkpg.cendio.se:300/app/ui.js:95:32
>    promiseReactionJob@[native code]

Comment 1 Samuel Mannehed cendio

2022-10-26 15:52:50 CEST

Upstream noVNC report:

https://github.com/novnc/noVNC/issues/1577

Comment 2 Samuel Mannehed cendio

2022-10-26 15:53:23 CEST

Created attachment 1072 [details]
Screenshot showing the JavaScript crash in Safari

Comment 3 Samuel Mannehed cendio

2022-10-26 16:09:19 CEST

The issue stems from the fact that disabling "cookies" in the browsers will also disable the JavaScript feature called "localStorage". Our code isn't written in a way that handles localStorage being blocked like this, thus the crash. In practice, we don't NEED localStorage, it's only used for user preferences. We could easily fall back on the default values here.

However, it's worth noting bug 8015 here, until that one is fixed it's impossible to use Web Access with cookies disabled.

This leads to the conclusion that the best way forward here is to present a better error message to the user.

Comment 4 Samuel Mannehed cendio

2022-10-26 16:10:59 CEST

Google's services like calendar.google.com and gmail.com don't work with cookies disabled. The error shown by Google is:

> Cookies are disabled
> 
> Your browser has cookies disabled. Make sure your cookies are enabled and try again. Learn more

Comment 6 Adam Halim cendio

2025-01-20 14:05:39 CET

After the noVNC vendor drop, disabling cookies will no longer trigger a crash. Instead, I get a "Failed to connect to server" message.

As mentioned in comment #3, it would be nice to display a better message if cookies/localStorage are disabled.

Comment 7 Adam Halim cendio

2025-01-20 14:10:50 CET

I tried disabling localStorage on firefox (about:config -> dom.storage.enabled = false).

Logging in with web access will trigger an error:

> ThinLinc Web Access encountered an error:
> 
> localStorage is null
> localStorageGet@https://10.48.2.23:300/app/webutil.js:213:9
> readSetting@https://10.48.2.23:300/app/webutil.js:159:17
> start@https://10.48.2.23:300/app/ui.js:120:21

Comment 8 Adam Halim cendio

2025-01-22 09:54:56 CET

In the scope of the noVNC vendor drop (bug 8484), we don't have time to fix a nice error message, so let's leave this for now.