Our team has already tried to fix the issue for a week now and none of the approaches seem to fix the issue. Does the Firefox dev department have any hints or clues for u… (read more)
Our team has already tried to fix the issue for a week now and none of the approaches seem to fix the issue. Does the Firefox dev department have any hints or clues for us?
Short description:
Firefox network.lna.blocking blocks same-origin/loopback requests when the page is controlled by a Service Worker
Symptom:
Login via OIDC fails in Firefox (the backend call after the IdP redirect is blocked). The error disappears if either network.lna.blocking=false is set or the Service Worker is disabled.
Environment:
- Frontend (react) and backend run on the same machine (loopback/localhost)—no cross-network scenario.
- Firefox with active network.lna.blocking (experimental Local Network Access feature, Chromium’s equivalent is Private Network Access).
Root Cause (Analysis):
1. apps/react/sw.js registers a global fetch listener via Workbox and calls workbox.core.clientsClaim(). This causes every open page to be immediately controlled by the Service Worker.
2. registerServiceWorker() is called unconditionally on every app start, regardless of authentication state—even on the login/OIDC page.
3. The app uses hash-routing (URL fragments like “#/oidc”); the login page and the rest of the app share the same document URL, so you can’t restrict the SW scope to “everything except login.”
4. Once a page is Service-Worker-controlled, every fetch—including requests not explicitly handled by Workbox routes—first goes through the SW’s fetch event (default behavior when any fetch listener is registered) before proceeding to the network if it isn’t intercepted.
5. Hypothesis: Firefox’s LNA implementation doesn’t correctly inherit the address-space classification (loopback/private/public) for SW-forwarded requests across the controlling client. A direct document fetch (loopback→loopback) is allowed, but an identical target fetch routed through the SW is blocked.
Reproduction (minimal):
1. Use Firefox with network.lna.blocking=true (the default in affected versions).
2. Load a page that registers a Service Worker with a fetch-event listener (e.g. via Workbox precacheAndRoute + clientsClaim()).
3. Ensure both the page and the target resource are served from localhost/loopback.
4. From the SW-controlled page, call fetch() against the loopback target resource → the request is blocked.
5. By comparison, the same fetch from a non-SW-controlled page succeeds.
6. Setting network.lna.blocking=false also allows the fetch to succeed under SW control.
Excluded Causes:
- Different address spaces for frontend/backend (both are on the same loopback machine)—ruled out.
- Misclassification due to redirect_uri or cross-origin navigation—the OIDC redirect is a top-level navigation (unaffected); only the subsequent backend call (token exchange/session validation in SsoLogin.tsx → ssoLoginSubmit) fails.
