Steps: 1. Install the latest build of the extension 2. Go to apps-preview.mozilla.org 3. Install "Forces of War" natively 4. Run Forces of War natively 5. Select the facebook login button to login Expected: A pop-up dialog box should appear allowing the user to login via facebook. Actual: No pop-up appears.

Confirmed to still be happening from testing the marketplace open web application.

This is definitely a problem with pretty much anything that does integration to external origin. Common use case is anything that has pop-ups, including: - Persona Integration - Clicking facebook, google plus like buttons - JavaScript pop-ups Moving to critical, given that this greatly causes problems in functionality from a user's perspective, as many applications do use pop-ups.

I need to know how many apps this will affect. If it's a large number of partner apps then I need to speak with BD to get their take on it.

F

Investigation needed on the following applications: - Backpack - Basecamp - Campfire - Highrise - Ta-Da List - Lord of Ultima - Soundcloud - Times Crossword - Sky Guide

Per a discussion with Kumar, this will prevent in-app payments from working correctly in the desktop WebRT, given that they rely on logging in with browser ID, which uses a pop-up.

Time Crossword also relies on persona integration. Without this fixed, this application has limited functionality. Switching this to block marketplace beta.

This stops account management also from working in Soundcloud.

Jen to follow up with BD on this bug.

From my perspective having looked at around 60 submissions and on the marketplace product side of things: * I've seen around 10 submissions affected by this, where primary functionality of an app is unusable without Facebook Connect pop-up (many of these are BD-sourced apps) * one of our important goals for this milestone was getting feedback on in-app purchases. We did a ton of work to hustle and get in-app payments ready for this release, and we're thwarted by the BrowserID pop-up not being able to open. If this can't be fixed more generically, a temporary solution for FBConnect and BrowserID would solve most of the problems I've run into.

Builds on bug 707836 for controlling navigation and bug 732631 for allowing popups to explicitly allow https://browserid.org navigation in a popup.

(In reply to Edward Lee :Mardak from comment #13) > Created attachment 618751 [details] [diff] [review] > v1 > > Builds on bug 707836 for controlling navigation and bug 732631 for allowing > popups to explicitly allow https://browserid.org navigation in a popup. What about facebook connect? That's very common in web apps, especially top apps. Also, how will we address this in the long run? An app probably should be able to control the "allowed_origins" parameter (bug 741955).

(In reply to Jason Smith from comment #14) > how will we address this in the long run? In the long run, at least for Persona, is to implement navigator.id.. that still doesn't address the issue of facebook connect though.

Comment on attachment 618751 [details] [diff] [review] v1 r=myk with Facebook Connect's origin added to this list and a bug filed to implement an manifest-specified list of allowed origins!

Comment on attachment 618751 [details] [diff] [review] v1 Erm, I'm going to make this r+ with conditions noted in comment 16 so you can carry forward review and land the patch with Facebook Connect added to the list.

Erm, and I've gone ahead and filed the followup bug (bug 749415).

Explicitly allow Persona https://browserid.org and Facebook Connect https://www.facebook.com for now.

(In reply to Ms2ger from comment #21) > https://hg.mozilla.org/mozilla-central/rev/94f63dd34a0d Is this is really resolved fixed in this case? The fix only addresses pop-ups with facebook and browser ID.

If you need the bug to remain open after its patch lands, put "[leave open]" on the whiteboard.

Flagging qawanted to test the two origins added.

We can close this for now. Myk has already filed a followup bug 749415.

Okay. Updated the bug title, so that the fix reflects the name of the bug for tracking purposes.

Verified for browser ID pop-up.

Verified with facebook login.

Moving this back to resolved fixed. There's a test case in question to reopen this bug, involving the facebook like button: Example Test Case Steps: 1. Install Sandglaz (https://marketplace-dev.allizom.org/en-US/app/sandglaz-1/) 2. Launch that application 3. Click the facebook like button on the bottom of the application Expected: A application pop-up should appear for www.facebook.com login. Actual: The default browser starts. Logging in will result in going to page of nothingness, probably cause it's trying to redirect back to the application. Additional Notes: Similar issue occurs with google plus +1 button, although it's we don't have that whitelisted yet.

Moving this back to verified per an email from Myk. Will open a separate bug to track the facebook like button and google +1 button issue.