Question about EFF's HTTPS Everywhere add-on for Firefox

[timandsteffi 2]

Today I added a new user to my Emby server (for the first time), but realised I couldn't set a password for this new user ('person'). The UI kept showing an error about invalid username or password, even though I was still logged in as me (a user with 'Allow this user to manage the server'). This is the error from the logs:

2017-07-12 11:05:53.7826 Info HttpServer: HTTP POST http://mediaserver.timsstuff.eu:8096/emby/Users/5b433730b41a4047be386cca188b17b8/Password. UserAgent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0
2017-07-12 11:05:53.7919 Info UserManager: Authentication request for person has been denied.
2017-07-12 11:05:53.7977 Error HttpServer: Error processing request
        *** Error Report ***
        Version: 3.2.25.0
        Command line: /usr/lib/emby-server/bin/MediaBrowser.Server.Mono.exe -programdata /var/lib/emby-server -restartpath /usr/lib/emby-server/restart.sh
        Operating system: Unix 4.4.0.83
        64-Bit OS: True
        64-Bit Process: True
        Mono: 4.8.1 (Stable 4.8.1.0/22a39d7 Tue May  2 22:26:20 UTC 2017)
        Processor count: 4
        Program data path: /var/lib/emby-server
        Application directory: /usr/lib/emby-server/bin
        System.AggregateException: One or more errors occurred. ---> System.ArgumentException: Invalid user or password entered.
          at MediaBrowser.Api.UserService+<PostAsync>c__async2.MoveNext () [0x0019d] in <190cb35d88d048658e4585cf76f0610a>:0
           --- End of inner exception stack trace ---
          at System.Threading.Tasks.Task.WaitAll (System.Threading.Tasks.Task[] tasks, System.Int32 millisecondsTimeout, System.Threading.CancellationToken cancellationToken) [0x00242] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at System.Threading.Tasks.Task.WaitAll (System.Threading.Tasks.Task[] tasks, System.Int32 millisecondsTimeout) [0x00000] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at System.Threading.Tasks.Task.WaitAll (System.Threading.Tasks.Task[] tasks) [0x00000] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at MediaBrowser.Api.UserService.Post (MediaBrowser.Api.UpdateUserPassword request) [0x00008] in <190cb35d88d048658e4585cf76f0610a>:0
          at (wrapper dynamic-method) System.Object:lambda_method (System.Runtime.CompilerServices.Closure,object,object)
          at Emby.Server.Implementations.Services.ServiceExecGeneral+<CreateExecFn>c__AnonStorey2.<>m__0 (System.Object service, System.Object request) [0x00000] in <0cfc2dfc40eb4af5a1600e51d4d1b8d0>:0
          at Emby.Server.Implementations.Services.ServiceExecGeneral+<Execute>c__async0.MoveNext () [0x0010a] in <0cfc2dfc40eb4af5a1600e51d4d1b8d0>:0
        --- End of stack trace from previous location where exception was thrown ---
          at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () [0x0000c] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Threading.Tasks.Task task) [0x0004e] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Threading.Tasks.Task task) [0x0002e] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd (System.Threading.Tasks.Task task) [0x0000b] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1+ConfiguredTaskAwaiter[TResult].GetResult () [0x00000] in <dbb16e0bacdc4a0f87478e401bc29b6c>:0
          at Emby.Server.Implementations.Services.ServiceHandler+<ProcessRequestAsync>c__async1.MoveNext () [0x0016b] in <0cfc2dfc40eb4af5a1600e51d4d1b8d0>:0
        --- End of stack trace from previous location where exception was thrown ---

[timandsteffi 2]

I found the workaround this is:

As of emby-server 3.2.25 it's not possible to add a new user and then set their password while still logged in as you (i.e a user with 'Allow this user to manage the server'). Instead do:
- login as yourself (i.e a user with 'Allow this user to manage the server') and add the new user
- sign out
- at the login page click on the new user, their password will be blank so this should just log you straight in
- now that you're logged in as that user click the user icon in the top right->Profile and change the password

 

I wonder if a fix for this bug could be considered? Since if I'm logged in as a user with 'Allow this user to manage the server'  and I have enough rights/permissions to add users I should be able to then go an set the passwords of users I create. It's a bit of a possible security hole too - if you forget to do this process, and the user themselves is never prompted, you end up with a user with no password who anyone can login as.

[Luke 37125]

I've tested and it works fine. We have seen this occasionally with firefox in some specific environments. unfortunately i cannot reproduce it. i would try resetting your browser to default settings and removing any browser add-ons. thanks.

[timandsteffi 2]

Yep, a browser add-on was the problem. I experimented a bit more and found that I needed to disable the EFF's HTTPS Everywhere add-on for Firefox. Once that add-on was disabled, and I closed and restarted the browser the issue didn't happen anymore.

[Luke 37125]

Thanks for the feedback.

[timandsteffi 2]

I submitted a bug report for HTTPS Everywhere over on Github. https://github.com/EFForg/https-everywhere/issues/11042