tip buttons broken

[chadwhitacre]

This is a regression introduced with #88.

steps

• visit a person on Gittip
• click "GitHub" at bottom to authenticate
• click a tip button

expected

Tip changes.

actual

403 from tip.json

[chadwhitacre]

I'm not able to reproduce locally.

It's something in the cookie interaction. I wouldn't rule out a bug in Aspen's cookie implementation.

[chadwhitacre]

When I first hit a page I see:

Set-Cookie:csrf_token=7YSfyblahblahblah; expires=Fri, 28 Jun 2013 16:38:48 GMT; Path=/

Then when I click "GitHub" and land back on the page I have:

Set-Cookie:csrf_token=7YSfyblahblahblah; expires=Fri, 28 Jun 2013 16:41:26 GMT; Path=/, session=6604537blahblahblah; expires=Fri, 06 Jul 2012 16:41:26 GMT; httponly; Path=/

Then when I click a tip button I get this from tip.json:

Set-Cookie:csrf_token=7YSfyblahblahblah; expires=Fri, 28 Jun 2013 16:45:07 GMT; Path=/, session=; expires=Thu, 01 Jan 1970 00:00:00 GMT; httponly; Path=/

[chadwhitacre]

Locally when I first hit a page I see:

Set-Cookie:csrf_token=UBcpKXblahblahblah; expires=Fri, 28 Jun 2013 16:42:52 GMT; Path=/

Then when I land back at the page I get:

Set-Cookie:csrf_token=UBcpKXblahblahblah; expires=Fri, 28 Jun 2013 16:43:33 GMT; Path=/, session=f9520ablahblahblah; expires=Fri, 06 Jul 2012 16:43:33 GMT; httponly; Path=/

When I tip I get this from tip.json:

Set-Cookie:csrf_token=UBcpKXblahblahblah; expires=Fri, 28 Jun 2013 16:46:04 GMT; Path=/, session=f9520ablahblahblah; expires=Fri, 06 Jul 2012 16:46:04 GMT; httponly; Path=/

[chadwhitacre]

So the session is cleared somehow when I hit tip.json. This happens in production but not locally. Does the server receive the session token and fail to set it again on the way out? Or does the server not receive the session token?

[chadwhitacre]

It happens in production from all three of these pages:

• my personal page, the buttons for the people I tip
• a claimed account /foo/
• an unclaimed account /github/foo/

[chadwhitacre]

It only happens for tip.json. I can otherwise browse around the site and not have my session dropped.

Oh! I bet it's the is_secure check. That's an environmental difference.

[chadwhitacre]

Let's see if that does it ...

[chadwhitacre]

Okay, appears to have worked.

[chadwhitacre]

Phew!

[chadwhitacre]

Scrappy not-even-really-a-startup could use some best practices. :-/