kyuucr/add-link-to-qbittorrent-webui

403 Forbidden when third party cookies is disallowed

Closed this issue · 6 comments

slemmnord commented

Hi!

When adding magnet link i get 403 error.
Looking at the code in background.js i'm thinking cookies are taken from wrong page. Perhaps "browser.cookies.getAll({url: tabUrl}).then(cookies => {" should instead be "browser.cookies.getAll({url: qbtUrl}).then(cookies => {"?

kyuucr commented

It is correct since I need to get all cookies that is associated with the tab, and include it into the POST request to the qbittorent server. This is for cases where you need auth cookies from the tab's site when downloading the torrent file from the site. When the extension sends the POST XHR, the auth cookie for qbittorrent server should be included automatically. So the only explanation that I can give you is that you are not authorized for some reason, could be issue on the server itself.

I can suggest a temporary fix: try to enable "Bypass authentication for clients in these IP subnets (CIDR notation)" option on the server.

Can you give me step by step to reproduce this? Please be specific (did you redirected to your server's url to login? what magnet url are you adding?) so I can diagnose the problem.

slemmnord commented

Thanks for looking into this!
I found the problem is caused due to disallowing all third party cookies in FF settings. Setting it to "Always" or "From visited" makes it work.
Neither solution (cookie policy or auth bypass for ip) is a good one from privacy and security viewpoint.

kyuucr commented
slemmnord commented

I suggest create new settings to store Qbt WebUI username and password and do a login when 403 is returned. Perhaps cache the returned cookie in session-storage to reduce subsequent logins.

kyuucr commented

Yes, it is possible, but still won't solve the problem. I can write a login procedure, and it will return auth cookie, but I still can't apply that cookie to the XHR request since it's forbidden to set or modify cookie for any request.

kyuucr commented

Here are the options:

  1. I can query for the third party cookie option to notify users, but it will need privacy permission, adding extraneous permission that is not directly used in the main functionality.
  2. I can change the third party cookie option, it also need privacy permission, but it feels way overstepping the boundary.
  3. I can add a disclaimer at start or at addon page, that users need to allow third party cookie or it won't work properly.

Currently I prefer option #3