Skip to content

mWeb - Error message displayed when trying to upload document on onfido flow and user is redirected to Company step  #6085

New issue
New issue
Closed
Closed
mWeb - Error message displayed when trying to upload document on onfido flow and user is redirected to Company step #6085
Assignees
jasperhuangg
Labels
EngineeringHourlyKSv2

Description

@isagoico
isagoico
opened on Oct 27, 2021

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

Action Performed:

  1. Navigate to add a bank account modal
  2. Enter some bank account credentials that trigger the Onfido flow
  3. Select drivers license
  4. Take a picture of anything

Expected Result:

Picture should be uploaded and then scanned by onfido

Actual Result:

There's an error just as the image is uploaded. User is redirected back to company step.

Workaround:

None found. Onfido is blocked on mWeb.

Platform:

Where is this issue occurring?

  • Mobile Web

Version Number: 1.1.10-0

Reproducible in staging?: Yes
Reproducible in production?: No

Logs: https://stackoverflow.com/c/expensify/questions/4856

Notes/Photos/Videos: Any additional supporting documentation

Expensify/Expensify Issue URL:

Issue reported by: Applause
Slack conversation:

View all open jobs on GitHub

Activity

  1. isagoico
    added
    DeployBlockerCashThis issue or pull request should block deployment
    Engineering
    DailyKSv2
    on Oct 27, 2021
  2. MelvinBot
    assigned
    jasperhuangg
    on Oct 27, 2021

  3. MelvinBot commented on Oct 27, 2021

    @MelvinBot
    MelvinBot
    on Oct 27, 2021
    Contributor

    Triggered auto assignment to @jasperhuangg (Engineering), see https://stackoverflow.com/c/expensify/questions/4319 for more details.

  4. OSBotify commented on Oct 27, 2021

    @OSBotify
    OSBotify
    on Oct 27, 2021
    Contributor

    👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open StagingDeployCash deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

    1. Identify the pull request that introduced this issue and revert it.
    2. Find someone who can quickly fix the issue.
    3. Fix the issue yourself.
  5. github-actions
    added
    HourlyKSv2
    and removed
    DailyKSv2
    on Oct 27, 2021
  6. jasperhuangg
    closed this as completedon Oct 27, 2021

  7. roryabraham commented on Oct 27, 2021

    @roryabraham
    roryabraham
    on Oct 27, 2021
    Contributor

    @jasperhuangg Did you mean to close this?

  8. roryabraham commented on Oct 27, 2021

    @roryabraham
    roryabraham
    on Oct 27, 2021
    Contributor

    I'm assuming that was a mistake because this was closed without a comment or PR, reopening.

  9. roryabraham
    reopened this on Oct 27, 2021

  10. kavimuru commented on Oct 27, 2021

    @kavimuru
    kavimuru
    on Oct 27, 2021

    @jasperhuangg @roryabraham Adding video for the above bug.

    20211027_183524.mp4

  11. roryabraham commented on Oct 27, 2021

    @roryabraham
    roryabraham
    on Oct 27, 2021
    Contributor

    @kavimuru Can you confirm the account(s) you used to test this? kavi.utest+chatd@gmail.com ?

  12. roryabraham commented on Oct 27, 2021

    @roryabraham
    roryabraham
    on Oct 27, 2021
    Contributor

    Logs don't appear to reveal much 😕 :

    [hmmm] Onfido error in RequestorStep ~~ error: 'Unknown error' userAgent: 'Mozilla/5.0 (Linux; Android 10; SM-G973W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.50 Mobile Safari/537.36'

  13. 9 remaining items

  14. jasperhuangg commented on Oct 27, 2021

    @jasperhuangg
    jasperhuangg
    on Oct 27, 2021
    Contributor

    Also unrelated but this deploy blocker isn't showing up in my K2

  15. jasperhuangg commented on Oct 28, 2021

    @jasperhuangg
    jasperhuangg
    on Oct 28, 2021
    Contributor

    Ah, after some poking around @roryabraham and I figured out that it's actually the browser blocking the request to upload the ID picture to this endpoint.

    Screen Shot 2021-10-27 at 5 06 35 PM

    If you're wondering why I have a screenshot of the Network tab from the Desktop version of Chrome (even though this is a mobile web issue): Onfido only allows us to upload documents from a mobile client. However Onfido doesn't actually check the user-agent–their JS just checks the screen size–meaning we can reproduce this on any browser.

    @justinpersaud Looks like this has to do with the CSP we've enabled for staging. Do you think it's safe to get rid of this deploy blocker?

  16. marcaaron commented on Oct 28, 2021

    @marcaaron
    marcaaron
    on Oct 28, 2021
    Contributor

    Do you think it's safe to get rid of this deploy blocker?

    Let's fix the CSP issue, retest, then remove the blocker?

  17. roryabraham commented on Oct 28, 2021

    @roryabraham
    roryabraham
    on Oct 28, 2021
    Contributor

    More details on the CSP errors:

    image

    index.js:26 Refused to load the script 'https://www.woopra.com/track/ce/?ra=rkQQmI5tHL4a&alias=onfido-js-sdk.com&instance=onfidojssdkwoopra&ka=24000&meta=&screen=375x812&language=en-US&app=js-client&referer=&idle=0&vs=r&cookie=e7m1bmxiirrV&event=started%20flow&cv_sdk_version=6.8.0&cv_client=staging.new.expensify.com&ce_is_custom_ui=true' because it violates the following Content Security Policy directive: "script-src 'self' https://polyfill.io https://cdn.plaid.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
...
...
Refused to connect to 'https://api.onfido.com/v3/documents' because it violates the following Content Security Policy directive: "connect-src 'self' https://*.pusher.com wss://*.pusher.com https://*.pusherapp.com https://staging-secure.expensify.com https://www.expensify.com wss://sync.onfido.com https://telephony.onfido.com blob:".
...
Refused to connect to 'https://sentry.io/api/109946/store/?sentry_key=6e3dc0335efc49889187ec90288a84fd&sentry_version=7' because it violates the following Content Security Policy directive: "connect-src 'self' https://*.pusher.com wss://*.pusher.com https://*.pusherapp.com https://staging-secure.expensify.com https://www.expensify.com wss://sync.onfido.com https://telephony.onfido.com blob:".

  18. justinpersaud commented on Oct 28, 2021

    @justinpersaud
    justinpersaud
    on Oct 28, 2021
    Contributor

    Let's fix it instead of just pushing to production. CSP was never enabled in production yet, and is on hold right now.

    It can be updated here https://github.com/Expensify/Cloudflare-Workers/blob/master/new.expensify.com/wrangler.toml#L12

  19. roryabraham commented on Oct 28, 2021

    @roryabraham
    roryabraham
    on Oct 28, 2021
    Contributor

    Got a PR up to hopefully fix this:

    https://github.com/Expensify/Cloudflare-Workers/pull/15

    It's approved, but we need it to be merged and deployed by ring0 before we can retest.

  20. fukawi2
    closed this as completedon Oct 28, 2021

  21. roryabraham commented on Oct 28, 2021

    @roryabraham
    roryabraham
    on Oct 28, 2021
    Contributor

    Reopening for testing

  22. roryabraham
    reopened this on Oct 28, 2021

  23. roryabraham commented on Oct 28, 2021

    @roryabraham
    roryabraham
    on Oct 28, 2021
    Contributor

    Verified this is fixed, closing this out 🎉

  24. roryabraham
    closed this as completedon Oct 28, 2021

  25. marcaaron commented on Oct 28, 2021

    @marcaaron
    marcaaron
    on Oct 28, 2021
    Contributor

    Thanks @roryabraham !! 🙇‍♂️

  26. bondydaa commented on Oct 28, 2021

    @bondydaa
    bondydaa
    on Oct 28, 2021
    Contributor

    I think this was from Jasper testing this before the fix was out right? https://github.com/Expensify/Expensify/issues/182916

  27. roryabraham commented on Oct 28, 2021

    @roryabraham
    roryabraham
    on Oct 28, 2021
    Contributor

    I think this was from Jasper testing this before the fix was out right?

    Yep, looks like it

  28. github-actions
    removed
    DeployBlockerCashThis issue or pull request should block deployment
    on May 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

EngineeringHourlyKSv2

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions