Vincent Lefevre Reporter
	Description • 9 years ago

When accessibility.blockautorefresh is set to true, I can't login to impots.gouv.fr.

For those who have an access:
1. Go to http://www.impots.gouv.fr/portal/static/
2. Click on "Particulier" (top/right).
3. Enter number and password.
4. Click on "Valider".

If accessibility.blockautorefresh is set to true, a blank page appears with an URL of the form https://cfspart.impots.gouv.fr/LoginMDP?op=c&url=... and the page source is empty. This is no notification. Reloading has no effect.

If accessibility.blockautorefresh is set to false, the right page appears (with a different URL).

	Marco Zehe (:MarcoZ)
	Comment 1 • 9 years ago

Gijs, who can investigte this best?

	:Gijs (he/him)
	Comment 2 • 9 years ago

Does this reproduce with invalid credentials? Because I can't reproduce with them, and because I don't have valid credentials, I can't really investigate what's going on. :-\

	Vincent Lefevre Reporter
	Comment 3 • 9 years ago

No, this is not reproducible with invalid credentials as in this case, one gets an error immediately.

FYI, here are the HTTP headers captured with the "Live HTTP headers" extension when I clicked on "Valider". I've replaced sensitive information by xxxx, yyyy, zzzz, and 9999 respectively.

https://cfspart.impots.gouv.fr/LoginMDP?op=c&url=xxxx=

POST /LoginMDP?op=c&url=xxxx= HTTP/1.1
Host: cfspart.impots.gouv.fr
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: application/xhtml+xml;q=0.95,text/html;q=0.9,text/xml;q=0.85,application/xml;q=0.85,text/plain;q=0.8,image/png,application/pdf;q=0.9,application/postscript;q=0.8,*/*;q=0.5
Accept-Language: fr-fr,fr;q=0.8,en-us;q=0.6,en-gb;q=0.4,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: https://cfspart.impots.gouv.fr/LoginMDP?op=c&url=xxxx=
Cookie: lemondgi=_test_client
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 212
url=xxxx%3D&LMDP_Spi=9999&LMDP_Password=yyyy&LMDP_Spi_tmp=9999&LMDP_Password_tmp=yyyy
HTTP/1.1 200 OK
Date: Wed, 28 Jan 2015 10:46:26 GMT
Server: Apache
refresh: 0; URL=https://cfspart.impots.gouv.fr/portal/dgi/public/prefsna2/gestionprefs?urlDest=xxxx%3D
Set-Cookie: lemondgi=zzzz; domain=.impots.gouv.fr; path=/
Via: anppusx008
Content-Length: 0
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=ISO-8859-1

	:Gijs (he/him)
	Comment 4 • 9 years ago

Great, thanks!