Can't log in (permission denied to access property "github-response" on cross-origin object)

[willcassella]

I've (almost) never been able to log into crates.io. Currently, every time I click the 'log in with Github' button, a small browser window opens up, appears to begin loading crates.io, and then quickly disappears. Nothing else seems to change.

I've tried revoking the OAuth application from Github, clearing cookies, as well as logging out of Github before trying to log in from crates.io. I've also tested on Chrome/Firefox/Edge on Windows 10, as well as Firefox on Arch Linux. I've found two issues which appear similar to what I'm experiencing, but neither solution worked for me.

I first tried logging in a few months ago, then a few weeks ago, then today hoping it would randomly just work but it hasn't. I used OBS to record the window that pops up when I try to log in, but I can't find any similar issues on Google.

I recently discovered that I can reliably log in from Firefox (safari) on my iPhone, but that doesn't seem to improve the desktop situation at all.

Any help would be appreciated, thanks!

[sgrif]

Can you provide as many specific details about your environment as possible? (OS, exact browser version, etc)?

[carols10cents]

I'm also interested in:

clearing cookies

Was this github.com cookies, crates.io cookies, all cookies?

Is there anything different about the network you're on on your computer versus your phone? Such as ISP, firewalls, etc? Given that it's happening in all the browsers on your computer, I'm less inclined to think it's a browser or OS problem....

[jtgeibel]

Permission denied to access property "github_response" on cross-origin object

Given this message and the URL, it looks like this is related to the usage of window.opener in github_authorize.js. The popup is opened to a github domain, and then redirected back to us. Perhaps some headers (like CORS) are being dropped somewhere causing modern browsers to treat the parent and child windows as different origins, even though at this point in the workflow they are both on the crates.io domain.

[willcassella]

Can you provide as many specific details about your environment as possible?

Tested on the following (can't repro error message, but same behavior):

Windows 10 Pro 1709:

• Firefox 61.0b12 (64-bit)
• Chrome 67.0.3396.79 (64-bit)
• Edge 41.16299.402.0

Manjaro 17.1.10:

• Firefox 60.0.2 (64-bit)

Was this github.com cookies, crates.io cookies, all cookies?

All cookies

I've tried on a few different networks (WiFi networks for computer, WiFi and cellular for phone), and it never works on my computer. Also recently it stopped working on my phone as well (Firefox for iOS and Safari for iOS).

[carols10cents]

@jtgeibel

Given this message and the URL, it looks like this is related to the usage of window.opener in github_authorize.js. The popup is opened to a github domain, and then redirected back to us. Perhaps some headers (like CORS) are being dropped somewhere causing modern browsers to treat the parent and child windows as different origins, even though at this point in the workflow they are both on the crates.io domain.

Wouldn't this cause login to fail for everyone though?

[carols10cents]

@willcassella I'm really sorry we haven't been able to figure this out yet :(

Tested on the following (can't repro error message, but same behavior):

By this, do you mean you see a window pop up and then close, and nothing about the crates.io page changes? What happens if you reload the page at that point, are you logged in or no?

Also recently it stopped working on my phone as well (Firefox for iOS and Safari for iOS).

That's really bizarre. Has anything changed with your phone since login was working?

[jtgeibel]

Wouldn't this cause login to fail for everyone though?

Yeah @carols10cents, it wasn't very clear from my original description, but I'm agreeing with your assessment that it could be network related. That's what I meant by headers potentially being dropped, possibly by some middlebox. I can't think of what else would cause this to show up cross-browser, cross-device, and cross-platform.

@willcassella are you on a corporate network that might be doing HTTPS interception? Is there anything else unique about the network that you can think of? You mentioned that on your phone you tried WiFi and cellular, but I'm not quite clear on if this now fails on your phone for both networks.

[willcassella]

Back again!

By this, do you mean you see a window pop up and then close, and nothing about the crates.io page changes? What happens if you reload the page at that point, are you logged in or no?

Manjaro is the only system where the pop-up lingers long enough that I can see grab a screenshot of it. Every other system it just sort of flashes in a then disappears. Refreshing the page doesn't change anything.

are you on a corporate network that might be doing HTTPS interception?
I've tried on several networks (home WiFi, work WiFi, cellular) and it's always the same result. When it worked on my phone though it didn't seem to depend on the network.

[VersBinarii]

Experiencing exactly the same issue on Firefox 66.0b5 at the https://www.crates.io/ URL.

The login process works correctly at https://crates.io/.

Maybe you could simply redirect all traffic from https://www.crates.io/ to https://crates.io/ ?

[jtgeibel]

@VersBinarii thank you very much for the comment. I'm not certain if the CSP issue is related (although it is something we should fix as well), however I have confirmed that it is not possible to login from www.crates.io (on Firefox stable). I expect that his is actually restricted on the GitHub end, because the "homepage URL" doesn't match exactly as the domains are technically different.

As you said, we should be redirecting www to the apex domain.

[manifest]

The same problem. Firefox 65.0 and Chrome 71.0.3578.98 (macOS Mojave). Any workaround for this one?

[jtgeibel]

@willcassella and @manifest I'm wondering, do you have a valid email set in your GitHub profile? We try to send an email on account creation if GitHub provides us with an email address, and if that address is invalid then it looks like we're failing the entire new user transaction.

[manifest]

@jtgeibel yes, the problem was because of invalid public email in my profile. I've managed to log in. Thanks.