ubuntuone.com should test for acceptance of cookies

[Rolf Leggewie]

I'd actually prefer if ubuntuone.com did not use cookies at all, but I guess these days it is getting to be impossible for web masters to code without cookies ;-)

Signin will continually fail without a good error message indicating the reason if cookies for ubuntuone.com are blocked.

[John O'Brien (jdobrien)]

Rolf Leggewie wrote:
> Signin will continually fail without a good error message indicating the
> reason if cookies for ubuntuone.com are blocked.

Did you get the following error? This is what I got with cookies disabled:

Unexpected form data

Launchpad doesn't understand the form data submitted in this request.

[Rolf Leggewie (r0lf)]

No. Again, there was no error message to speak of.

[Joshua Hoover (joshuahoover)]

I did a quick test of signing in via Firefox 3 on Ubuntu 9.04 and got the same error John O'Brien did:

Unexpected form data
Launchpad doesn't understand the form data submitted in this request.

[vikhyath (vikhyath-gmail)]

temporary work around:

Enable cookies and login to launchpad, and use your launchpad account page
https://launchpad.net/~<userid>

on the top right on this page it says "log in"
click on it and don't close this page or log out.

Open this page in a new TAB
www.ubuntuone.com

now click on login

[Joshua Hoover (joshuahoover)]

Adding to Canonical SSO Provider project as I believe the requirement for cookies at login is controlled there.

[Stuart Metcalfe (stuartmetcalfe)]

Bumping to our next release due to time constraints.

[Anthony Lenton (elachuni)]

Probably this helps: http://docs.djangoproject.com/en/dev/topics/http/sessions/#setting-test-cookies

[David Owen (dsowen)]

I can reproduce if I accept cookies from login.ubuntu.com but reject from one.ubuntu.com. The handle this scenario, one.ubuntu.com must check for cookie acceptance.

[Stuart Metcalfe (stuartmetcalfe)]

Arguably, both sites should check for cookies if they require them, as it's possible for a user to reject cookies for each site independently. SSO should certainly perform its own check.