Connectivity: wifi Gaia/device: 1.4/hamachi steps to reproduce: 1. Install payments-alt on your firefoxOS phone 2. Launch the app 3. Settings -> Sign in 4. Sign in using a valid verified FxA account expected behavior: sign in is successful actual behavior: Sign in fails with the following JS error 09-23 13:08:40.159 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [req] GOT https://payments-alt.allizom.org/api/v2/fireplace/consumer-info/?dev=firefoxos&lang=en-US&limit=10 09-23 13:08:40.159 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [consumer_info] Consumer info retrieved. 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [user] Updating user settings [object Object] 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [user] Saving settings to localStorage 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [mkt] Triggering initial navigation 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [nav] Received navigate event: /fxa-authorize?state=40969d05631a48978bdddb333e274601&code=210c8b2e184cc49372df8e69e5f7b4c8f5b3ef568678ab43818daecb9c7731e7 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [nav] Updating scrollTop with replaceState 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [nav] Using replaceState due to fresh load 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [nav] Navigation started: /fxa-authorize?state=40969d05631a48978bdddb333e274601&code=210c8b2e184cc49372df8e69e5f7b4c8f5b3ef568678ab43818daecb9c7731e7 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [views] Routing /fxa-authorize 09-23 13:08:40.169 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [req] Opening pool 09-23 13:08:40.179 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [cache] Persisting request cache 09-23 13:08:40.179 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [model] Persisting model cache 09-23 13:08:40.179 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [req] Closing pool 09-23 13:08:40.179 E/GeckoConsole( 552): Content JS LOG at https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850:8 in u/<: [nav] Pushed state onto stack: /fxa-authorize 09-23 13:08:40.189 E/GeckoConsole( 552): [JavaScript Warning: "Content Security Policy: allow directive is deprecated, use the equivalent default-src directive instead"] 09-23 13:08:40.399 E/GeckoConsole( 552): [JavaScript Error: "TypeError: l.body.attr(...) is undefined" {file: "https://payments-alt-cdn.allizom.org/media/fireplace/js/include.js?b=1411425683850" line: 7}] 09-23 13:08:40.469 E/QCAL

So, here's what I think is going on here: The origin for our marketplace packaged apps is "app://packaged.marketplace.firefox.com". The web flow for FxA login redirects to "https://payments-alt.allizom.org/fxa-authorize?...", which then runs js which fails to access the DOM for the packaged app. The immediate solution that comes to mind is to use a different OAuth key for packaged apps, so we can have a different app:// redirect URL. It's not clear how we'd handle configuration for this; maybe build the client id into the packaged app instead of having it ask the server for it.

Further investigation indicates the error mentioned in the bug title is unrelated and harmless. The packaged app's message listener does in fact receive the auth code from the popup window, it was just rejecting it since it did not come from an app:// origin. I've changed fireplace to expect the message from the host it sends API requests to. https://github.com/mozilla/fireplace/commit/01f9e0041