proton.me login: Invalid Access Token Topic is solved

[Michaell]

PM 33.7.0 64bit, Win 10 1709, clean portable profile for test
Toolkit Error Console:
with my usual profile, no errors, only one warning repeated a gazillion times
with clean portable install:

Code: Select all

Timestamp: 5/15/2025 10:59:49 AM
Error: [Exception... "Component returned failure code: 0x80004002 (NS_NOINTERFACE) [nsIWebProgress.DOMWindow]"  nsresult: "0x80004002 (NS_NOINTERFACE)"  location: "JS frame :: chrome://browser/content/browser.js :: onStateChange :: line 11160"  data: no]

repeated 3 additional times, and this once:

Code: Select all

Timestamp: 5/15/2025 10:59:49 AM
Error: Error: 
Source File: https://account.proton.me/assets/static/public-index.13beec2b.js
Line: 1952

And examples of warnings, some repeated

Code: Select all

Timestamp: 5/15/2025 10:59:30 AM
Warning: Content Security Policy: Couldn’t parse invalid host 'wasm-unsafe-eval'
Timestamp: 5/15/2025 10:59:47 AM
Warning: Content Security Policy: Ignoring “https://account-api.proton.me” within script-src: ‘strict-dynamic’ specified
Timestamp: 5/15/2025 10:59:47 AM
Warning: Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified
Timestamp: 5/15/2025 10:59:47 AM
Warning: Successfully compiled asm.js code (total compilation time 6ms; not stored in cache (too small to benefit))
Source File: https://account-api.proton.me/challenge/v4/html?Type=0&Name=unauth
Line: 0
Timestamp: 5/15/2025 11:03:35 AM
Warning: Key event not available on some keyboard layouts: key=“i” modifiers=“accel,alt,shift” id=“key_browserToolbox”
Source File: chrome://browser/content/browser.xul
Line: 0

Nothing new in Error Console after clicking Sign in button, just the "Invalid Access Token" notification.
Proton is working in Librewolf 132. This started a few days ago. I understand it's the site changing their code that causes these problems.

[andyprough]

This started a few days ago. I understand it's the site changing their code that causes these problems.

Can confirm. I checked, and proton.me is also showing this bug on older Pale Moon version 33.5.0 with a clean profile which is a version from December 2024. Proton.me definitely worked over the past year, so this is a bug that was definitely introduced by Proton.

I will send in a support request. It would be good if you could send one as well, @Michaell. I'm using Trisquel GNU/Linux, so it will be good if Proton can hear it from users of both of our OS's.

[Michaell]

I've never reported any of the problems to Proton. I'm just a lowly free user using a non-preferred browser.

[suzyne]

I've never reported any of the problems to Proton. I'm just a lowly free user using a non-preferred browser.

Even so, it is to Proton's benefit to ensure that their web email client works on a broad a set of browsers.

I would like to think that they would welcome feedback even from a free account. Especially since this issues may be the difference between a user upgrading to a paid tier, or not.

[andyprough]

I've never reported any of the problems to Proton. I'm just a lowly free user using a non-preferred browser.

OK, I don't know what the troubleshooting options are for free accounts. But I have a paid account and have worked through bugs related to Pale Moon with Proton before, so I'll report it. If you are able to get signed in on another browser, you can click on your profile name in the upper righthand corner, select "Help and Feedback" from the sub-menu that pops up, and from there select "Report a problem". It's good if you can give all the information you did here in your first post and let them know you are on Pale Moon on Windows.

Update: I got an automated response with a support request number (3688729). Next I'll probably get an email from a triage person telling me that Pale Moon is not officially supported, so I'll try to politely push past that and get this fixed or try to get them to provide information for our developers.

[Michaell]

I did a report but not expecting it to help much.

[andyprough]

I did a report but not expecting it to help much.

It helps to show that more than one person is running into this problem, even if no one at Proton responds to you.

I got an email response this morning from someone with Proton support. She asked me to try it with all extensions turned off (still fails), stating that "An extension could be causing this warning: Warning: Content Security Policy: Couldn’t parse invalid host 'wasm-unsafe-eval'."

And she wanted me to check to see if the sign-in problem was happening for me in any other browser (not failing), including in their mobile app (not failing). So I'm being asked troubleshooting questions right now, which is probably a good sign that someone at Proton might be beginning to look into it. I've sent my responses, I'll update you as this proceeds.

[Michaell]

Working again.

[andyprough]

Here's what I received today from Proton -

Our development team looked into the issue. They were able to locate and fix the problem. There was an issue with a 3rd-party dependency that uses the PerformanceObserver API https://caniuse.com/mdn-api_performanceobserver in that it's assuming that the Pale Moon browser API exists.

Could you please ask the Pale Moon developers to add support for this API?

The fix should be deployed today.

Looks like a request in there for @Moonchild regarding that API.

[Gemmaugr]

I have ProtonMail, but don't have this issue. I'm also constantly logged in and go directly to the inbox..

Performance Observer exists in Tools>Preferences>Privacy>Tracking>Scripting. Mine is not ticked (and I think I've disabled it in About:Config too)

[Moonchild]

We have support for performance observers but because this is a development API (it has no real-world use for website functionality (all it does is provide timing features and measurement) and is only truly useful for metrics/profiling/etc.), should not be used in a production context, and has massive privacy-impacting consequences (fingerprinting becomes a lot more trivial with it) it is disabled by default.
I'm not comfortable enabling the API by default and ask proton to please consider not relying on it and/or pass this privacy concern on to the third party they use the dependency of.

[andyprough]

We have support for performance observers but because this is a development API (it has no real-world use for website functionality (all it does is provide timing features and measurement) and is only truly useful for metrics/profiling/etc.), should not be used in a production context, and has massive privacy-impacting consequences (fingerprinting becomes a lot more trivial with it) it is disabled by default.
I'm not comfortable enabling the API by default and ask proton to please consider not relying on it and/or pass this privacy concern on to the third party they use the dependency of.

OK, I'll pass that along.

If this happens again, would we just enable dom.enable_performance_observer in about:config, log in to proton.me, and then disable dom.enable_performance_observer again? Would that be the reasonable sequence?

[Moonchild]

If this happens again, would we just enable dom.enable_performance_observer in about:config, log in to proton.me, and then disable dom.enable_performance_observer again? Would that be the reasonable sequence?

It entirely depends on how deeply proton.me integrates this dependency. If it's only used for login, then yes, that's a workaround. if you don't care about the privacy risk, you can enable it permanently, too. it's in preferences for a reason.

[andyprough]

ask proton to please consider not relying on it and/or pass this privacy concern on to the third party they use the dependency of

From your lips to God's ears. Here's the email I got this morning:

Hi Andy, Thank you for the message. 

After sharing your message with the development team I have good news to share with you. Pale Moon will not have to enable the PerformanceObserver API, because we discontinued it's use as of yesterday. If there is nothing further that we can assist you with at this time, we will be closing this support request. 

Now, could you do us all a favor and straighten out Google real quick while you are at it?

[Moonchild]

Now, could you do us all a favor and straighten out Google real quick while you are at it?

Hahaha. If only!

But yes great to hear Proton recognised the privacy issue for what it is and took steps to avoid it.