6

I have attempted to add another login method, LiveJournal.

  1. Created a LiveJournal account (backuplogin.livejournal.com)
  2. Made sure I'm logged in to SE and LiveJournal.
  3. Went to user profile > edit > my logins > add more logins...

form

  1. After clicking "Log in", the page refreshes, showing me the same form, only without the username. No error message, and no new login.

Encountered here on Meta, and on Stats.SE. In Chrome and Firefox. Using http. The "backuplogin" OpenId is not associated with any SE account.

  • Hmm, noted. Will fix. Thanks for the report! – Adam Lear Aug 1 '15 at 7:06
  • The "Add More Logins" feature is broken not only for LiveJournal, but for other OpenID providers as well. The form posts to itself, and simply refreshes the page rather than redirecting to the OpenID provider. (Tested with a personal OpenID delegated to launchpad.net.) – ʇsәɹoɈ Aug 3 '15 at 21:26
4

Wellll.... that's embarrassing. The page was posting to the wrong route, so naturally nothing worked.

A fix is out now, please let me know if you're still seeing issues.

  • Thanks. I hope you'll post when the fix is fully deployed. – ʇsәɹoɈ Aug 3 '15 at 21:28
  • @ʇsәɹoɈ It's all out now. Takes about 10 minutes to deploy fully to production. :) – Adam Lear Aug 3 '15 at 21:29
  • Looks like it's now triggering NoScript's XSS protection, causing the process to fail for people who use NoScript. Can that be fixed as well? – ʇsәɹoɈ Aug 3 '15 at 21:33
  • @ʇsәɹoɈ We don't really support NoScript. I'll try to remember to install it and test this out since it'd be nice not to fail (and also verify that there's no actual XSS), but in the meantime, try adding exceptions for our domains instead of that's a thing in NoScript. – Adam Lear Aug 3 '15 at 21:37
  • Considering how immensely popular NoScript is, and the fact that it is one of a handful of tools that significantly protect users against common web exploits, I suggest you reconsider that policy. (By the way, I have implemented OpenID providers and relying parties, and they never triggered NoScript. I don't expect it would be difficult for you to make your implementation compatible as well.) – ʇsәɹoɈ Aug 3 '15 at 21:48
  • It mostly works now. The first time I got "No OpenID identifier was provided" after entering userid and clicking Login. Then repeated the process, successfully. Then did it again with another openid, same story: 1st attempt unsuccessful, the second is. Maybe I'm bad at clicking. – user259867 Aug 3 '15 at 23:01
  • Also, this XSS thing is a regression. Logging in with OpenID did not trigger NoScript's XSS protection when I used it yesterday. – ʇsәɹoɈ Aug 4 '15 at 0:02
  • @ʇsәɹoɈ Well, yesterday adding a login credential didn't work, so... ;) Are you talking about logging in instead? Either way, this should have been only a UI change. I'll have to try to repro the XSS thing to see what's what. – Adam Lear Aug 4 '15 at 5:22
  • @NormalHuman Still talking Livejournal specifically? – Adam Lear Aug 4 '15 at 5:25
  • Yes, this was my experience with two LJ logins I created. I'll try again... – user259867 Aug 4 '15 at 5:31
  • Now it worked on the first try. Maybe I indeed misclicked something. – user259867 Aug 4 '15 at 5:33
  • @Anna Lear - Adding a login credential didn't work yesterday, but logging in with an existing credential did work, and I don't remember any sign of NoScript's XSS protection triggering when I tested it. Now logging in triggers the XSS protection, and fails unless that protection is disabled. – ʇsәɹoɈ Aug 4 '15 at 9:24

You must log in to answer this question.