Bug 12690 – REGRESSION: can not log in to bank of america with TOT webkit

• Component: Page Loading
• Status: RESOLVED FIXED

[Jordan Breeding]

using webkit.app I can start to log in to bank of america, but when it has me confirm my sitekey and enter my password it always fails to accept my password and log me in

switching back to safari.app makes it work again

[David Kilzer (:ddkilzer)]

Jordan, thanks for the bug report!  Do you have the Debug menu enabled in Safari?  If so, are there any messages that appear in the JavaScript Console when you log in?  Are there any resources that don't load in the Activity window (from the "Window" menu) when you try to log in?

If you don't have the Debug menu enabled, could you enable it and test logging in again?

http://www.macosxhints.com/article.php?story=20030110063041629

[Jordan Breeding]

Created attachment 13072 [details]
JavaScript Console

[Jordan Breeding]

Created attachment 13073 [details]
JavaScript Code

[Jordan Breeding]

I just uploaded two attachments, one is just the JS Console, the other is the JavaScript code that showed when I drilled down on the error in the console.

[David Kilzer (:ddkilzer)]

Jordan, do you have any experience with HTML, JavaScript and CSS?  To determine what's causing this, we probably need someone with a Bank of America account to "reduce" the error to a relatively small amount of HTML+JavaScript+CSS that will reproduce the bug.  (It's okay if you don't--I'm just asking in case you have such experience.)

Also, looking at this JavaScript code, there is a lot of document.all usage.  I wonder if BoA is detecting the WebKit nightly as MSIE and using the wrong "set" of JavaScript files (since it works with shipping Safari)?

https://sitekey.bankofamerica.com/sas/sas-docs/chat/chat_deployment_global/lp/ADACompliant.js

Mark, do you have any contacts at Bank of America that could test this internally?

[Mark Malone]

I'll contact BofA.   

[Maciej Stachowiak]

<rdar://problem/4990044>

[Rosyna]

I'd like to add that this appears to occur on the post to the final form. In the current ToT, instead of showing the account info, it redirects to the main BofA page.

https://sitekey.bankofamerica.com/sas/signon.do is the site for signing in.

[Brady Eidson]

I just successfully logged into my BofA account using ToT WebKit...  what revision is failing for you?

[Rosyna]

r19572 is the revision failing for me. Note that I have a sitekey enabled and that I have checking and credit card account (I'm not sure if the procedure is different if you JUST have a checking account or JUST have a credit card account).

[Brady Eidson]

I have a credit card acct and an auto loan acct.  But the procedure to login is the same - I just confirmed this with angryluke

[Rosyna]

Ok, I just tried it with a bunch of the old nightlies.

The problem occurred somewhere between r18004 and r18012. 18004 logs in fine, 18012 has the issue.

[Brady Eidson]

If I could reproduce this with my BofA account, I could build and try the intermediates between 18005 and 18011...  alas I cannot repro...  I'll give those Changelogs a looksy

[Jordan Breeding]

One further note.  Without "block pop-ups" enabled it seems to redirect to the front page as Rosyna pointed out.  With "block pop-ups" enabled it just loads the page telling you that authentication failed.

[Jordan Breeding]

Actually, as of revision 19713 Webkit.app seems to just redirect to the main page regardless of the pop up blocking setting.

[Antti Koivisto]

I can't reproduce this with my BofA checking account.

[Rosyna]

I can still repro this as of r19911

[Jordan Breeding]

I can still reproduce this as well, Bank Of America makes you choose which state your account is registered in.  Is it possible that this is also affecting things?  If so my account is in Texas.

[Antti Koivisto]

After trying a few I can now reproduce this as well. It does not fail every time for me, I can occasionally log in succesfully. 

[Antti Koivisto]

It is broken by r18011

[David Kilzer (:ddkilzer)]

(In reply to comment #20)
> It is broken by r18011

http://trac.webkit.org/projects/webkit/changeset/18011

[Antti Koivisto]

Created attachment 13449 [details]
turn multiple form submission protection back on

Includes HTTP layout test.

Note that this protection does not fully match what other browsers are doing. I'll file bugs for issues I noticed. Those are not regressions from shipping WebKit.

[Maciej Stachowiak]

Comment on attachment 13449 [details]
turn multiple form submission protection back on

r=me

I think it would be ok to remove the MULTIPLE_FORM_SUBMISSION_PROTECTION ifdef, now that we know the protection is needed.

I think it would be good to also mention the other bugs this fixes in the ChangeLog.

[Antti Koivisto]

r19940 (with #ifdefs removed)

Should also fix bug 12604 and bug 12020

[Antti Koivisto]

*** Bug 12604 has been marked as a duplicate of this bug. ***

[Antti Koivisto]

*** Bug 12020 has been marked as a duplicate of this bug. ***

[Dimitri Glazkov (Google)]

It's interesting that the test in this bug does the opposite in FF/IE.