{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3687","repository_url":"https://api.github.com/repos/mozilla/fxa-content-server","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3687/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3687/comments","events_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3687/events","html_url":"https://github.com/mozilla/fxa-content-server/issues/3687","id":151121587,"number":3687,"title":"Signing in to Hello after Sync generates zombie sessions that cannot be killed","user":{"login":"shane-tomlinson","id":848085,"avatar_url":"https://avatars.githubusercontent.com/u/848085?v=3","gravatar_id":"","url":"https://api.github.com/users/shane-tomlinson","html_url":"https://github.com/shane-tomlinson","followers_url":"https://api.github.com/users/shane-tomlinson/followers","following_url":"https://api.github.com/users/shane-tomlinson/following{/other_user}","gists_url":"https://api.github.com/users/shane-tomlinson/gists{/gist_id}","starred_url":"https://api.github.com/users/shane-tomlinson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shane-tomlinson/subscriptions","organizations_url":"https://api.github.com/users/shane-tomlinson/orgs","repos_url":"https://api.github.com/users/shane-tomlinson/repos","events_url":"https://api.github.com/users/shane-tomlinson/events{/privacy}","received_events_url":"https://api.github.com/users/shane-tomlinson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/fxa-content-server/labels/waffle:backlog","name":"waffle:backlog","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-04-26T12:33:07Z","updated_at":"2016-08-03T14:39:25Z","closed_at":"2016-08-03T14:39:25Z","body":"Ref https://github.com/mozilla/fxa-auth-server/issues/1239\r\n\r\nFollow on notes from @rfk:\r\n\r\n-------------------------------------\r\n\r\n@jrgm not only do these STR produce an unexpected \"New signin\" email, they generate an unkillable zombie session that cannot be logged out of.  STR:\r\n\r\n* Do all the things @jrgm said above, so you're logged in to both Sync and Hello\r\n* Go into Sync preferences and disconnect from sync\r\n* Go into the Hello settings and log out of Hello\r\n* Restart your browser just to be sure there's no transient state\r\n* Visit https://accounts.firefox.com\r\n\r\nExpected result: I should be signed out, because I signed out in both places that I signed in\r\n\r\nActual result:  I'm still logged in to FxA, and there's no \"sign out\" button anywhere that will let me sign out.\r\n\r\nIf I understand what's happening here, the Hello login is generating a fresh sessionToken, but not clearing the sessionTokenConext, so we still thing the token is associated with sync.  The sequence of logins takes accounts.firefox.com through the following states:\r\n\r\n* Initial state -> (sessionToken=null, sessionTokenContext=undefined)\r\n* Log in to sync -> (sessionToken=token1, sessionTokenContext=\"fx_desktop_v1\")\r\n\r\nIn this state, we don't show a \"sign out\" button on the web interface, because the session is owned by sync.\r\n\r\n* Log in to Hello -> (sessionToken=token2, sessionTokenContext=\"fx_desktop_v1\")\r\n\r\nNow we *think* the session is owned by sync, but it isn't.  We incorrectly fail  to show the \"sign out\" link.\r\n\r\nFrom here, logging out of Sync will destroy token1, but that won't affect accounts.firefox.com because it's already forgotten about that token.  Logging out of Hello won't destroy token2, because Hello is an OAuth relier and never sees the session-token.\r\n\r\nBleh."},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/comments/237255989","html_url":"https://github.com/mozilla/fxa-content-server/issues/3687#issuecomment-237255989","issue_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/3687","id":237255989,"user":{"login":"vladikoff","id":128755,"avatar_url":"https://avatars.githubusercontent.com/u/128755?v=3","gravatar_id":"","url":"https://api.github.com/users/vladikoff","html_url":"https://github.com/vladikoff","followers_url":"https://api.github.com/users/vladikoff/followers","following_url":"https://api.github.com/users/vladikoff/following{/other_user}","gists_url":"https://api.github.com/users/vladikoff/gists{/gist_id}","starred_url":"https://api.github.com/users/vladikoff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vladikoff/subscriptions","organizations_url":"https://api.github.com/users/vladikoff/orgs","repos_url":"https://api.github.com/users/vladikoff/repos","events_url":"https://api.github.com/users/vladikoff/events{/privacy}","received_events_url":"https://api.github.com/users/vladikoff/received_events","type":"User","site_admin":false},"created_at":"2016-08-03T14:39:25Z","updated_at":"2016-08-03T14:39:25Z","body":"https://support.mozilla.org/en-US/kb/hello-status and https://bugzilla.mozilla.org/show_bug.cgi?id=1287827 💀 .\r\n\r\nPlease open new issues if we have any follow up actions here"}}
{"actor":{"display_login":"vladikoff"}}