{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/4463","repository_url":"https://api.github.com/repos/mozilla/fxa-content-server","labels_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/4463/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/4463/comments","events_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/4463/events","html_url":"https://github.com/mozilla/fxa-content-server/issues/4463","id":191963764,"number":4463,"title":"Changing password with incorrect email capitalization will brick your password","user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-28T10:03:06Z","updated_at":"2016-11-28T10:07:17Z","closed_at":null,"body":"Steps to reproduce:\r\n\r\n* Create an account, say \"example@gmail.com\"\r\n* Sign out, and sign back in with different email capitalization, say \"Example@gmail.com\"\r\n* Wait 15 minutes and/or restart memcached, to avoid the aggressive rate limited identified in https://github.com/mozilla/fxa-auth-server/issues/1570\r\n* Change your password\r\n* Sign out, and try to sign back in\r\n\r\nExpected result:\r\n\r\n* I should be able to sign back in using the password I just set.\r\n\r\nActual result:\r\n\r\n* I can't sign in.\r\n\r\nThe problem is in this \"password change\" flow: https://github.com/mozilla/fxa-js-client/blob/master/client/FxAccountClient.js#L828\r\n\r\nWhen it calls `/password/change/start`, it detects that you entered a different email capitalization, and retries the request with the original capitalization stored on the account.  But when it calls `/password/change/finish` to set the new `authPW`, it uses the capitalization you entered at login, not the canonical one.  In other words, the value of `email` on this line:\r\n\r\n  https://github.com/mozilla/fxa-js-client/blob/master/client/FxAccountClient.js#L844\r\n\r\nDoes not get updated to reflect the proper capitalization.  It calculates a bogus value for `authPW` and then stores that on the account.\r\n\r\nThe result is that you can no longer log in to the account:\r\n\r\n* If you try to login using the original capitalization, then your calculation of `authPW` will not match what's on the server, and the login will be rejected.\r\n* If you try to login using a different capitalization, then the server will reject it with an \"incorrect email case\" error.\r\n\r\nISTM the quick fix here is to change the js-client, so that it propagates the updated email address through the whole password-change flow.  But there may be other edge-cases here that we need to think through."},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/comments/263231454","html_url":"https://github.com/mozilla/fxa-content-server/issues/4463#issuecomment-263231454","issue_url":"https://api.github.com/repos/mozilla/fxa-content-server/issues/4463","id":263231454,"user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"created_at":"2016-11-28T10:07:17Z","updated_at":"2016-11-28T10:07:17Z","body":"Resetting the password does seem to fix the problem though.  Fortunately the password-reset email gets sent using the canonical capitalization, so when you re-set `authPW` through that flow, you're using the right value."}}
{"actor":{"display_login":"rfk"}}