pwa-wp icon indicating copy to clipboard operation
pwa-wp copied to clipboard

"SecurityError: The operation is insecure" on Firefox

Open szepeviktor opened this issue 5 years ago • 10 comments

Please check the returned Promise. It could be rejected with a certain cookie setting See https://bugzilla.mozilla.org/show_bug.cgi?id=1429714#c1

kép

szepeviktor avatar Mar 03 '20 12:03 szepeviktor

So we're missing a catch() call here?

https://github.com/GoogleChromeLabs/pwa-wp/blob/261c15ee65f643b5dec4927d7ece403b8b02424f/wp-includes/service-workers.php#L161-L186

westonruter avatar Mar 03 '20 22:03 westonruter

Seems like...

szepeviktor avatar Mar 03 '20 23:03 szepeviktor

Would you like to open a PR? Should it be putting the error in the console via console.error()?

westonruter avatar Mar 03 '20 23:03 westonruter

Thank you for your offer! I better not touch frontend code.

szepeviktor avatar Mar 04 '20 03:03 szepeviktor

I can't reproduce this issue. In private browsing, navigator.serviceWorker is not even defined. The same goes if I select to not remember history in non-private browsing.

westonruter avatar Mar 04 '20 06:03 westonruter

Try telling Firefox to delete cookies on exit - that is mentioned in the bug tracker. about:preferences#privacy

kép

szepeviktor avatar Mar 04 '20 06:03 szepeviktor

OK, I can see that now:

Screen Shot 2020-03-04 at 21 14 34

With this patch:

diff --git a/wp-includes/service-workers.php b/wp-includes/service-workers.php
index 2197787..17cb864 100644
--- a/wp-includes/service-workers.php
+++ b/wp-includes/service-workers.php
@@ -183,6 +183,9 @@ function wp_print_service_workers() {
 									} );
 								} );
 							<?php endif; ?>
+						} )
+						.catch( ( err ) => {
+							console.info( "Service worker will not be installed due to:", err );
 						} );
 
 						<?php if ( is_admin_bar_showing() && ! wp_service_worker_skip_waiting() ) : ?>

The result is:

Screen Shot 2020-03-04 at 21 15 47

Doesn't seem a whole lot better.

westonruter avatar Mar 05 '20 05:03 westonruter

I think we need .reject() too https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/reject

szepeviktor avatar Mar 05 '20 08:03 szepeviktor

No, I don't think that is right. The reject is already being called today by the browser today. When a rejected promise is not caught via catch then it shows up on the console as an error. You can see from my code above that adding catch does prevent the error from showing in the console, but the Firefox DevTools still shows another error regardless. So I don't know how much benefit there is to catch it in the first place.

westonruter avatar Mar 06 '20 21:03 westonruter

Yes, we have the same problem as others in the Mozilla bug:

Neither try/catch nor then/catch seems to be able to supress the error warnings in the console.

https://bugzilla.mozilla.org/show_bug.cgi?id=1429714#c12

szepeviktor avatar Mar 06 '20 22:03 szepeviktor