Firefox bug related to 'delete cookies... on exit' causes client-side JS to fail

[zEdS15B3GCwq]

Hi,

I've set up Cloud Commander on a remote box and accessing it through an SSH tunnel - this works perfectly. However, when I proxy pass to CC via Apache2, although the main page loads, none of the JS actions seem to be working - e.g. the right-click menu is unchanged, and the bottom menu bar items don't do anything. What am I doing wrong?

Any help would be greatly appreciated.

Both apache2 and cc are in docker containers, running on a common bridge network.

My setup in httpd.conf:

    <Location /cloudcmd/>
        AuthType basic
        AuthName "cloudcmd"
        AuthUserFile /usr/local/apache2/secrets/htpasswd
        <RequireAll>
            Require user cloudcmd
            Require ssl
        </RequireAll>
        ProxyPass http://cloudcmd:8000/cloudcmd/
        ProxyPassReverse http://cloudcmd:8000/cloudcmd/
        ProxyPassReverseCookieDomain localhost xxx.yyy.zzz.www
        ProxyPassReverseCookiePath / /cloudcmd
    </Location>

.cloudcmd.json:

    "name": "",
    "auth": false,
    "username": "",
    "password": "",
    "algo": "sha512WithRSAEncryption",
    "editor": "edward",
    "packer": "tar",
    "diff": true,
    "zip": true,
    "buffer": true,
    "dirStorage": false,
    "online": false,
    "open": false,
    "keysPanel": true,
    "port": 8000,
    "ip": null,
    "root": "/mnt/fs",
    "prefix": "/cloudcmd",
   ...

cc in compose.yml:

  cloudcmd:
    image: coderaiser/cloudcmd:latest-alpine
    container_name: cloudcmd
    networks:
      - front
    ...
    ports:
      - 127.0.0.1:35985:8000

CC accessed on localhost:8000 works as expected, accessing it through apache2 causes JS to not work (ports published or not).

[coderaiser]

Could you please tell me, do you have any errors in console of your browser or network panel?

[coderaiser]

So you still see an exception?

Uncaught (in promise) DOMException: The operation is insecure. cloudcmd.js:1
    CloudCmd https://MY_IP:MY_PORT/cloudcmd/dist/cloudcmd.js:1
    AsyncFunctionThrow self-hosted:694
    (Async: async)
    <anonymous> https://MY_IP:MY_PORT/cloudcmd/fs/:282

Could you please try if cloudcmd demo works for you?

[zEdS15B3GCwq]

No, sorry, that exception doesn't show if the "delete cookies..." option is off.

All I can see now is:

Content Security Policy: The report URI (about:blank) should be an HTTP or HTTPS URI. register.js:20:41

Content Security Policy: The page’s settings observed the loading of a resource at https://MY_IP:MY_PORT/cloudcmd/sw.js (“worker-src”). A CSP report is being sent. register.js:20:41

I'll try the demo soon.

[zEdS15B3GCwq]

demo - same situation, same errors as with the https proxied version. Turning the 'delete cookies' setting off (or adding the site as an exception) brings back the lost functionality.

[coderaiser]

Looks like a bug in Firefox, because Cloud Commander doesn’t use cookies.

[zEdS15B3GCwq]

Yes, based on the bug reports, it certainly is. Thanks for giving me hints to solve this issue.

[zEdS15B3GCwq]

Answer summarised:

This is a FF bug, discussed here:

https://bugzilla.mozilla.org/show_bug.cgi?id=1413615
mozilla/send#1222

Possible solution(s):

1. Unchecking "delete cookies and site data when FF is closed", or
2. Adding an exception for the site in the same option