Affected versions

• 86.0b3 (20210128185743)

Affected platforms

• Windows 7x64
• Windows 10x64

Preconditions

• The Firefox browser is uninstalled, all the registries and all the appdata are removed.

Steps to reproduce

1. Go to https://www-demo3.allizom.org/en-US/firefox/.
2. Click on the Download Firefox button.
3. Install and open Firefox and about:telemetry.
4. Search for dltoken or attribution and observe the strings.

Expected result

• The attribution data and download token strings are displayed.

Actual result

• No strings are displayed neither for dltoken or attribution data.

Regression range

• This is reproducible on https://www-demo3.allizom.org/en-US/firefox/ site which is used for testing PI-896

Notes

• Another thing worth mentioning is that there is no attribution data displayed in about:telemetry#environment-data-tab_settings.
• Attached a screenshot.
• We consider this an S2 because we cannot test PI-896 without the download token ID.

This happens on Windows 10x64 as well after deleting the profile data and registry.

I spent some time looking into this, and I believe the problem lies on the server side, rather than on the Firefox side. I downloaded a stub installer from the link indicated, and it does not appear to contain any attribution data in the signature section. All that I see are "real" signatures. This means that the server in question must not be writing the attribution data into the installer.

Correction: The "dummy" certificate exists. But it does not seem to contain any attribution data.

We found an issue on the demo website that was blocking the addition of the attribution data to links for staging bouncer. The fix is deployed and we verified that the data is being added to the download requests now. Hopefully this will get things working.

I just tested https://www-demo3.allizom.org/en-US/firefox/ and I still do not get any attribution data when I download an installer.

Can you watch dev tools and post here the https://bouncer-bouncer.stage.mozaws.net/ URL that it tries?

I see this URL in the network pane: https://bouncer-bouncer.stage.mozaws.net/?product=firefox-beta-stub&os=win&lang=en-US

Note, however, that I have been attempting to verify the attribution by downloading with Edge, because I believe we do not bother with attribution when we see a download with Firefox. However, I am not familiar with Edge's developer tools, so I retrieved this URL using Firefox. Hopefully that URL does not also change depending on the downloading browser. I don't know how to be sure.

It will change with Firefox mostly if Tracking Protection is enabled. We don't load the GA or Attribution JS if the DNT signal is sent and ETP will block things even if they attempt to load. What we're looking for is something more like:

https://bouncer-bouncer.stage.mozaws.net/?product=firefox-beta-stub&os=win&lang=en-US&attribution_code=c291cmNlPShub3Qgc2V0KSZtZWRpdW09KGRpcmVjdCkmY2FtcGFpZ249KG5vdCBzZXQpJmNvbnRlbnQ9KG5vdCBzZXQpJmV4cGVyaW1lbnQ9KG5vdCBzZXQpJnZhcmlhdGlvbj0obm90IHNldCkmdWE9Y2hyb21lJnZpc2l0X2lkPTExNjg0MjU2MjcuMTYxMjE5NTE0Ng..&attribution_sig=5b102afbe8b56812244fc25258c89ab89b5623f18c16227b0941b6262604b8bd

Which is what we saw earlier today in our testing after the fix mentioned above.

Best thing to try is probably Chrome. Good dev tools and definitely doesn't block GA.

I figured out how to get into Edge's developer tools. This is the URL I saw:

https://bouncer-bouncer.stage.mozaws.net/?product=firefox-beta-stub&os=win&lang=en-US&attribution_code=c291cmNlPShub3Qgc2V0KSZtZWRpdW09KGRpcmVjdCkmY2FtcGFpZ249KG5vdCBzZXQpJmNvbnRlbnQ9KG5vdCBzZXQpJmV4cGVyaW1lbnQ9KG5vdCBzZXQpJnZhcmlhdGlvbj0obm90IHNldCkmdWE9ZWRnZSZ2aXNpdF9pZD0xNTEzNDcxNDM3LjE2MTE5NTMyNTQ.&attribution_sig=a8bfd874ba970ead12bc940e17d293216ffff81e2107bda44e0fc7424a73491e

I double checked that the downloaded installer does not appear to contain any attribution data. If I download here, I do see attribution data.

Okay. Good. That attribution_code is base 64 endoded and decodes to

source=(not set)&medium=(direct)&campaign=(not set)&content=(not set)&experiment=(not set)&variation=(not set)&ua=edge&visit_id=1513471437.16119532

So we must have another issue upstream. Maybe the data is too long or the signature isn't validating? Would this kind of thing be in the stage bouncer logs Oremj?

pmac and I worked on this a bit and found a smaller error in the hmac code. This should be fixed now and ready for testing.

I don't know if the changes are supposed to be live yet, but I just downloaded a copy and am still seeing empty attribution data.

Hello,
After discussions on Slack and running tests on Windows 10 and Windows 7 we can confirm that this bug is fixed! Marking it as such.