[RESOLVED] ubs.com login hangs with ABE enabled

[skkukuk]

Hi,

I love noscript, but I am having a problem when I attempt to login in to the ubs online brokerage site at https://onlineservices.ubs.com/

edit: I am using firefox 3.6.13

After entering my id and password, the login page hangs and eventually times out with the standard firefox time out messages:
The connection was reset
The connection to the server was reset while the page was loading.

I believe the problem started around the last 2.0.5 build (sorry, not exactly sure which one). It was fixed in Version 2.0.6RC1, but then appears broken again in every version since then, up to and including 2.0.8.1RC1.

I don't have time to do a lot of research on this, especially since 2.0.6RC1 works. But in messing around today, it seems like if I disable ABE, I can login just fine. The weird thing is that until I close my browser, I can enable ABE again and logins work fine until I close the browser again, then logins no longer work in a new browser session.

I turned on noscript console logging, but didn't see anything interesting (to me) like an ABE error message. Here is what I get with 2.0.8.1RC1 in the error console:

[NoScript] Document OK: @https://onlineservices.ubs.com/olsauth/ex/pbl/ubso/pl --- PGFM: null

onlineservices.ubs.com : server does not support RFC 5746, see CVE-2009-3555

[NoScript] Document OK: @about:neterror?e=netReset&u=https%3A//onlineservices.ubs.com/olsauth/ex/pbl/ubso/pl&c=UTF-8&d=The%20connection%20to%20the%20server%20was%20reset%20while%20the%20page%20was%20loading. --- PGFM: null

[NoScript] Error filtering charset on https://onlineservices.ubs.com/olsauth/ex/pbl/ubso/pl: [Exception... "Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIChannel.contentCharset]" nsresult: "0x80040111 (NS_ERROR_NOT_AVAILABLE)" location: "JS frame :: chrome://noscript/content/Main.js :: anonymous :: line 4883" data: no]


I also tried creating a user ruleset in ABE as follows to try and bypass the problem:
Site .ubs.com
Accept from SELF++
Deny

But that did not appear to change anything.

I am now back on 2.0.6RC1 which works. Any ideas on how to get around this? Is anyone else having this problem?

Thanks!

[Giorgio Maone]

Does this happen also on a clean profile with just NoScript installed?

[skkukuk]

No - of course not! That would be too easy (for me that is)

On a clean profile it works fine with 2.0.8.1rc1. I exported my noscript settings and imported them on the clean profile, and it still works fine.

I have lots of changed firefox options and also other extensions, themes, plugins, etc.

How would you prefer that I proceed? Install other addons and themes on the clean profile? Disable on the main profile? Check firefox options first?

Is there an easy way to do this? I assume not, but figured I would ask!

Here are my addons, in case there are know problems:

Adblock Plus 1.3.2
Better Privacy 1.48.3
Cookie Whitelist, With Buttons 1.0.3
DownThemAll! 1.1.10
Favicon Picter 2 0.6.1.14
Ghostery 2.4.2
HTML Validator 0.8.6.1 (this is installed, but disabled)
IE View 1.4.5.1
Live HTTP headers 0.16
NoScript
oldbar 1.2
Open With 4.1.0
Organize Status Bar 0.6.4
Screengrab 0.96.3
UnPlug 2.035
WebMail Notifier 2.6.4

Themes:
Firefox 2, the theme, reloaded 0.9.8

Thanks!

[Giorgio Maone]

Is there an easy way to do this?

Standard Diagnostic

[skkukuk]

Well, that wasn't so bad...

Started in safe mode, all works fine (figured that since clean profile was fine)

Started normal, disabled four extensions, all works fine

Started normal, enabled two of the extensions, problem occurs.

Anyway, it appears there is a conflict between NoScript (some versions) and Live HTTP headers 0.16

Now, I am fine, since I can disable Live HTTP headers 99.999% of the time, and enable it only when I am debugging something that needs it. But I have had Live HTTP headers 0.16 installed since 9/1/2010 as far as I can tell. Is there someplace where you have a changelog or release history with the dates versions of NoScript were released? I am curious of when the problem started to occur, and why I didn't think of Live HTTP headers being the possible cause.

If there is anything you want me to do or check, let me know. Since Live HTTP headers 0.16 and some versions of NoScript work together fine for this UBS site, something changed in NoScript - but that doesn't mean NoScript is doing anything wrong now (or even before the change). If there is nothing else you want me to do, I am happy to just run with Live HTTP headers disabled.

Let me know - and thanks!

[Giorgio Maone]

ABE performs some low level HTTP magic, so if an extension like Live HTTP Headers makes too many (wrong) assumptions on HTTP channels (non documented) behavior, it may break stuff.
Good news is that I use HTTP Fox with no problem.

[skkukuk]

Hey - thanks for the info! I had not seen HTTP Fox before.

I like how HTTP Fox organizes all of the data, so you can get right to the parts you want. Live HTTP Headers may have some other benefits, but HTTP Fox will serve my needs. And I won't have to remember to disable it when I am done using it.

Thanks!