A user shared that Firefox crashes for two users as soon as they access MS services like portal.office.com. As soon as they exclude the users from the SSO configuration, it works again.

I think the issue might be from the fact that we neglect cases when device_headers is not present.

I managed to reproduce this issue by manually popping the device_headers header from the SSO cookie (Based on the log, I noticed that the device_headers header isn't present in the cookie).

Set release status flags based on info from the regressing bug 1768724

We might need to check if the patch fixes the issue before closing the bug (however, this patch was necessary).

https://hg.mozilla.org/mozilla-central/rev/a44743cb5d3e

(In reply to Sean Kim from comment #4)

We might need to check if the patch fixes the issue before closing the bug (however, this patch was necessary).

Sean, adding a need-info as a reminder for comment 4.
This will also need uplift requests for beta, release, and esr128.
The uplift requests for release need to be in by eod tomorrow (2024-11-08) to make the Fx132 planned dot release.

Created a combined one for uplifting two patches.

Please request Beta approval on this as well and fill out the approval request form.

beta Uplift Approval Request

• User impact if declined: Some users might experience a crash with Microsoft Entra SSO (macOS) if Microsoft's broker sends a cookie without a device header.
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: Low
• Explanation of risk level: We are only checking if a variable is null. We have already implemented this change on Nightly to confirm it works
• String changes made/needed: N/A
• Is Android affected?: no

esr128 Uplift Approval Request

• User impact if declined: Some users might experience a crash with Microsoft Entra SSO (macOS) if Microsoft's broker sends a cookie without a device header.
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: Low
• Explanation of risk level: We are only checking if a variable is null. We have already implemented this change on Nightly to confirm it works
• String changes made/needed: N/A
• Is Android affected?: no

https://hg.mozilla.org/mozilla-central/rev/ec149762ecaa

Example crash: https://crash-stats.mozilla.org/report/index/d0f89316-c9a4-4f64-a142-c980a0241108

Comment on attachment 9436270 [details]
Bug 1929622 - Improve error handling in SSO Cookie Parsing

Approved for 132.0.2.