Spotify Widget Still Rings Home

[Leakbang]

Browser: Firefox 86.0

Issue: The Spotify widget makes a connection to their servers even though Privacy Badger says that it has 'replaced' the Spotify widget.

Discovered on https://discord.com/app/

The Spotify widget contacts the following domains:
dealer.spotify.com
i.scdn.co
open.spotify.com

[ghostwords]

Hello! Is this before or after clicking to allow the widget to load? Just checking.

[Leakbang]

This is before allowing the widget. It loads before even asking.

[ghostwords]

Could you help me reproduce this problem? Do I need to share a Spotify song in Discord somehow?

[Leakbang]

Could you help me reproduce this problem? Do I need to share a Spotify song in Discord somehow?

Yeah, please follow these steps and it should be reproduced.

• Load the url https://discord.com/app
• In one of your chats have a Spotify link that triggers the widget (i.e. this random link https://open.spotify.com/playlist/3gSKt2XNzUpoXZheIoJxti?si=y3NlUWa3QECr_7-boNcV6Q)
• If you navigate to the widget, you should see that Privacy Badger has replaced the widget.

In my network logs I see that the 3 Spotify domains are called before even the widget is allowed or even if it is on the screen. I noticed that even if the widget is not rendered yet and is in another chat window, it still rings the Spotify servers.

I hope this has been enough.

[ghostwords]

Apologies for the delay. This was helpful, but I haven't been able to reproduce the problem. I see a single blocked request to open.spotify.com upon visiting the channel with a Spotify link in the chat. I see Privacy Badger's replacement placeholder under the Spotify link. I can then choose to allow the widget to load, which of course results in requests to various spotify.com and scdn.com domains.

[Dryader]

Trying this on my own system using Brave: Version 1.22.70 Chromium: 89.0.4389.105 (Official Build) (64-bit) and Windows 10 Version 20H2 and OS build 19042.867. I have turned off brave shields as well in order to keep it simple. Curiously enough maybe it's some sort of caching or something but even after completely relaunching the browser Privacy badger still allows the Spotify widget to load and only seems to replace it after a few seconds. Privacy badger does seem to allow the various scdn domains you talked about @ghostwords even with Privacy badger on. As well as dealer.spotify.com and open.spotify.com. What's curious is that Privacy badger does seem to correctly block all api.spotify.com, spclient.wg.spotify.com and apresolve.spotify.com requests but not all the requests of open.spotify.com. Even disabling cache in Devtools does not seem to change the results. Also the 2 requests to dealer.spotify.com never finish apparently and stall while downloading as well as 1 request from gateway.discord.gg. These 3 are both websocket requests with a status of 101 if that may be of use.

[Dryader]

As well when and if Privacy Badger correctly blocks the widget from loading seems to be completely random for both.

[Leakbang]

Thank you for confirming it. I was suspecting it only occurs on my machine.

[Dryader]

With brave shields on the difference seems to be by allowing third party cookies that changes the results with both fingerprinting and ad block both set to off. Essentially allowing third party cookies seems to be the factor whether privacy badger allows it to load parts of it first or block it correctly.

[Dryader]

Changing apresolve.spotify.com to yellow or green instead of red still loads some requests to open.scdn.co and open.spotify.com but seems to correctly replace the widget on reload every time.

[ghostwords]

If you see this happen when you restart the browser in a profile configured to reopen previously open tabs, you're probably running into #1845. Privacy Badger takes a little time to initialize itself. Since the browser doesn't wait for Privacy Badger when restoring tabs, it's possible for requests to go through before Privacy Badger is ready to deal with them.

If this happens outside of browser restarts, if you can reproduce just by opening a new window/tab and visiting Discord in an already-open browser, could you see if you can reproduce this in a new browser profile with a fresh installation of Privacy Badger (and no other extensions/all browser settings left to default values)?

Also, is this behaviour Discord-specific, or can you reproduce on other sites with embedded Spotify widgets? Let me know if you'd like me to find and post some examples.

[Leakbang]

If you see this happen when you restart the browser in a profile configured to reopen previously open tabs, you're probably running into #1845. Privacy Badger takes a little time to initialize itself. Since the browser doesn't wait for Privacy Badger when restoring tabs, it's possible for requests to go through before Privacy Badger is ready to deal with them.

If this happens outside of browser restarts, if you can reproduce just by opening a new window/tab and visiting Discord in an already-open browser, could you see if you can reproduce this in a new browser profile with a fresh installation of Privacy Badger (and no other extensions/all browser settings left to default values)?

Also, is this behaviour Discord-specific, or can you reproduce on other sites with embedded Spotify widgets? Let me know if you'd like me to find and post some examples.

I tried it on a fresh installation of Firefox (Version 87.0) on a fresh VM and yes it seems that you are right. It did not contact those domains until I manually allowed it and it was working as intended. So now that the issue has become evident is there a way to force Firefox to wait for the page load or are there any fixes for it?

[ghostwords]

So to be clear, is this the same issue as #1845? When you wrote Load the url https://discord.com/app in #2746 (comment), were you launching Firefox from a Discord URL shortcut in that step?

[Leakbang]

So to be clear, is this the same issue as #1845? When you wrote Load the url https://discord.com/app in #2746 (comment), were you launching Firefox from a Discord URL shortcut in that step?

Yep, the steps are identical. I also tried reloading the page and opening discord in new tabs or via different links but it seems that the Spotify widget is successfully getting blocked and only contacts their domains when I actually allow the widget.
Just to be clear, I never used a URL shortcut. I always directly loaded the URLs via the address bar.

[ghostwords]

Sorry, I'm still confused. If you can reproduce in an already-open Firefox browser, then this isn't the same as #1845. Could you clarify? What is different between the new Firefox installation where you can't reproduce this problem, and your current Firefox where you can?

[Dryader]

This happens outside of browser restarts for me and restoring brave settings to default corrects the problem, because third party cookies are blocked. Turning off brave shields to imitate what a chrome user might experience yields the same issue. If you could provide some examples of Spotify widgets I can check.

[Leakbang]

Sorry, I'm still confused. If you can reproduce in an already-open Firefox browser, then this isn't the same as #1845. Could you clarify? What is different between the new Firefox installation where you can't reproduce this problem, and your current Firefox where you can?

I can still reproduce the error in an already open Firefox. Sorry for not making it clear. In my current Firefox, I have some addons and the config is a bit modified. In the fresh Firefox, there are no extra addons installed (minus Privacy Badger) and there is the default config. I have no idea which configuration variable or addon is messing up with Privacy Badger's operations.

[ghostwords]

Here are a few Spotify widget examples:

• https://www.npr.org/2021/02/09/965903895/new-music-friday-the-top-8-albums-out-on-feb-12
• https://www.ajournalofmusicalthings.com/new-music-from-the-inbox-for-august-6-2018-rotten-mind-kississippi-joey-sweeney-the-neon-grease-more/
• https://www.heavyblogisheavy.com/2018/09/27/heavy-rewind-blind-guardians-nightfall-in-middle-earth/

[Dryader]

Weird, curiously I can't reproduce what had happened earlier, it seems to have fixed itself.