Brave VPN: Unable to load credentials/HTTP 500 error returned from endpoint, after first purchasing Leo Premium

[stephendonner]

Description

Brave VPN: Unable to load credentials/HTTP 500 error returned from endpoint, after first purchasing Leo Premium

Test Plan / Steps to Reproduce

1. install 1.65.28
2. launch Brave
3. purchase Brave Leo and/or Brave Talk Premium from either prod or staging account sites; confirm they work
4. try to purchase Brave VPN by clicking on Start free trial
5. complete Stripe-purchase/checkout flow
6. wait for You have active credentials loaded! green banner
7. click on the VPN button on the Brave-browser toolbar
8. wait

Actual result:

Unable to load credentials! error messaging

From log snippets and @evq it seems clear it's using cached credentials and failing

There's also HTTP 500s returned from the credential-provisioning endpoint for Brave VPN (appears to be on the Guardian side), with logging enabled:

[3788:1172:0222/165640.844:VERBOSE2:de_amp_throttle.cc(80)] deamp throttling: https://account.brave.com/account/?intent=provision&order_id=a6a125d7-1fbe-4c77-9135-035e3732bc96
[3788:1172:0222/165640.844:VERBOSE2:body_sniffer_url_loader.cc(52)] Start https://account.brave.com/account/?intent=provision&order_id=a6a125d7-1fbe-4c77-9135-035e3732bc96
[3788:1172:0222/165640.849:VERBOSE1:back_forward_cache_impl.cc(727)] BackForwardCacheImpl::GetFutureBackForwardCacheEligibilityPotential:  : No: HTTP status is not OK, scheme is not HTTP or HTTPS, main RenderFrameHost doesn't have response headers set, probably due not having successfully committed a navigation.
[3788:1172:0222/165640.851:VERBOSE1:request_sender.cc(182)] Request completed from url: https://go-updater.brave.com/extensions
[3788:1172:0222/165640.851:INFO:CONSOLE(0)] "Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.", source:  (0)
[3788:1172:0222/165640.851:VERBOSE2:request_sender.cc(129)] Omaha response received: )]}'
{"response":{"server":"prod","protocol":"3.1","daystart":{"elapsed_seconds":61001,"elapsed_days":6261},"app":[{"appid":"khaoiebndkojlmppeemjhbpbandiljpe","cohort":"1:cux:","status":"ok","cohortname":"Auto","ping":{"status":"ok"},"updatecheck":{"status":"noupdate"}}]}}
[3788:1172:0222/165640.852:VERBOSE1:component_updater_service.cc(456)] Update completed with error 0
[3788:1172:0222/165640.854:VERBOSE1:request_sender.cc(182)] Request completed from url: https://go-updater.brave.com/extensions
[3788:1172:0222/165640.854:VERBOSE2:request_sender.cc(129)] Omaha response received: )]}'
{"response":{"server":"prod","protocol":"3.1","daystart":{"elapsed_seconds":61001,"elapsed_days":6261},"app":[{"appid":"hfnkpimlhhgieaddgfemjhofmfblmnib","cohort":"1:2879:","status":"ok","cohortname":"Auto androidlowmem","ping":{"status":"ok"},"updatecheck":{"status":"noupdate"}}]}}
[3788:1172:0222/165640.854:VERBOSE1:component_updater_service.cc(456)] Update completed with error 0
[3788:1172:0222/165640.906:VERBOSE1:api_request_helper.cc(380)] [[OnResponse]] Response received

[3788:1172:0222/165640.906:VERBOSE1:api_request_helper.cc(328)] Creating DataDecoder for APIRequestHelper
[3788:1172:0222/165640.952:VERBOSE2:api_request_helper.cc(428)] Response validation successful
[3788:1172:0222/165640.952:VERBOSE1:brave_vpn_api_request.cc(271)] OnGetSubscriberCredential Response from API was not HTTP 200 (Received 500)
[3788:1172:0222/165640.952:VERBOSE2:brave_vpn_service.cc(617)] OnGetSubscriberCredentialV12 : failed to get subscriber credential
[3788:1172:0222/165640.952:VERBOSE2:brave_vpn_service.cc(769)] SetPurchasedState : FAILED

Expected result:

Loaded Brave VPN credentials

Reproduces how often:

100%

Brave version (brave://version info)

Brave | 1.65.28 Chromium: 122.0.6261.57 (Official Build) nightly (64-bit)
-- | --
Revision | c2e055a7ad1af320de4bc12174dde12172d9ebf7
OS | Windows 10 Version 22H2 (Build 19045.4046)

Version/Channel Information:

• Can you reproduce this issue with the current release? No
• Can you reproduce this issue with the beta channel? No
• Can you reproduce this issue with the nightly channel? Yes

Definitely a regression, I just don't-yet have a range nailed down, sorry!

cc @bbondy @mattmcalister @bsclifton @simonhong @brave/qa-team

[stephendonner]

This insidious "issue" stemmed from me leaving a prior test BraveVPN-Nightly VPN entry in macOS.

Leaving open for further diagnosis + followup; potentially, we can look into replacing bogus credentials from past configs, and refetch from Guardian, etc.?

[MadhaviSeelam]

@evq @nvonpentz @bsclifton while verifying the issue #35933, encountered above issue (Unable to load credentials error) in Win 11 x64. Checked in both 1.63.164 & current release 1.63.162

cc: @kjozwiak @LaurenWags

Brave | 1.63.164 Chromium: 122.0.6261.69 (Official Build) (64-bit)
-- | --
Revision | 0a640ded5b59268307d1ae11b74646763cb82b4c
OS | Windows 11 Version 23H2 (Build 22631.3155)

1.63.162-before Leo purchase	1.63.162-after Leo credentials refresh	1.63.164 (Fresh Leo purchase)

23912:18244:0227/142534.564:VERBOSE2:p3a_service.cc(282)] P3AService::OnHistogramChanged: histogram_name = Brave.DNS.AutoSecureRequests Sample = 2 bucket = 2
[23912:18244:0227/142534.790:VERBOSE1:api_request_helper.cc(380)] [[OnResponse]] Response received

[23912:18244:0227/142534.790:VERBOSE1:api_request_helper.cc(328)] Creating DataDecoder for APIRequestHelper
[23912:18244:0227/142534.840:VERBOSE2:api_request_helper.cc(428)] Response validation successful
[23912:18244:0227/142534.840:VERBOSE1:brave_vpn_api_request.cc(271)] OnGetSubscriberCredential Response from API was not HTTP 200 (Received 500)
[23912:18244:0227/142534.840:VERBOSE2:brave_vpn_service.cc(618)] OnGetSubscriberCredentialV12 : failed to get subscriber credential
[23912:18244:0227/142534.840:VERBOSE2:brave_vpn_service.cc(770)] SetPurchasedState : FAILED

[stephendonner]

I've asked that we prioritize getting to the bottom of https://github.com/brave/account-brave-com/issues/129 before we do more regression testing, esp. since there are likely to be more fixes/changes due to the above's resolution 👍

@MadhaviSeelam @brave/qa-team just FYI

[mattmcalister]

let's check with @AlanBreck about whether the backend and frontend changes that were made to support this are in an environment where you can test them

[bsclifton]

added release-notes/include - human readable title for this (for release notes) might be something like:
Fixed situation where Brave VPN purchase had issue when buying after Brave Leo.

[kjozwiak]

The above requires 1.68.85 or higher for 1.68.x verification 👍

[stephendonner]

Verification PASSED using

Brave | 1.68.85 Chromium: 126.0.6478.40 (Official Build) beta (64-bit)
-- | --
Revision | 8e76a669cf78bdfa933c8d569460092a01166588
OS | Windows 10 Version 22H2 (Build 19045.4474)

New Account - purchase Leo Premium, then VPN - PASSED

Steps:

1. installed 1.68.85
2. launched Brave using --enable-logging=stderr --v=1 --env-leo=staging --env-ai-chat.bsg=dev --env-ai-chat-premium.bsg=dev
3. loaded account.bravesoftware.com
4. purchased Leo Premium using june11@mailinator.com
5. clicked on Summarize this page
6. purchased Brave VPN

Confirmed ActiveCredentials for both, using brave://skus-internals

example	example	example	example

ActiveCredentials in brave://skus-internals

Leo	VPN

New Account - purchase VPN, then Leo Premium - PASSED

Steps:

1. installed 1.68.85
2. launched Brave using --enable-logging=stderr --v=1 --env-leo=staging --env-ai-chat.bsg=dev --env-ai-chat-premium.bsg=dev
3. loaded account.bravesoftware.com
4. purchased Brave VPN using june11-2@mailinator.com
5. confirmed I connected to a Brave VPN USA (West) node, using whatismyipaddress.com
6. purchased Leo Premium using june11-2@mailinator.com
7. confirmed I could Summarize this page over Premium

Confirmed ActiveCredentials for both, using brave://skus-internals

example	example	example

ActiveCredentials in brave://skus-internals

VPN	Leo

[LaurenWags]

@bsclifton does this change touch any Android related code? Should Android be checked as well?

[bsclifton]

@LaurenWags sorry for the long response time - yes, technically Android does hit this path too. However, I personally wouldn't test on Android unless you have extra cycles (optional IMO). Testing on Desktop covers the main case and Android has the same code branches when buying from account.brave.com (instead of using in-app-purchase).

[LaurenWags]

thanks @bsclifton!

[stephendonner]

Verification PASSED using

Brave | 1.68.88 Chromium: 126.0.6478.71 (Official Build) beta (x86_64)
-- | --
Revision | 70077e4ec26f79de0bac54bc09204be0a3e6cea6
OS | macOS Version 11.7.10 (Build 20G1427)

New Account - purchase Leo Premium, then VPN - PASSED

Steps:

1. installed 1.68.88
2. launched Brave using --enable-logging=stderr --v=1 --env-leo=staging --env-ai-chat.bsg=dev --env-ai-chat-premium.bsg=dev
3. loaded account.bravesoftware.com
4. purchased Leo Premium using june14@mailinator.com
5. clicked on Summarize this page
6. purchased Brave VPN

Confirmed ActiveCredentials for both, using brave://skus-internals

example	example	example	example

ActiveCredentials in brave://skus-internals

Leo	VPN

New Account - purchase VPN, then Leo Premium - PASSED

Steps:

1. installed 1.68.88
2. launched Brave using --enable-logging=stderr --v=1 --env-leo=staging --env-ai-chat.bsg=dev --env-ai-chat-premium.bsg=dev
3. loaded account.bravesoftware.com
4. purchased Brave VPN using june14-2@mailinator.com
5. confirmed I connected to a Brave VPN USA (West) node, using whatismyipaddress.com
6. purchased Leo Premium using june14-2@mailinator.com
7. confirmed I could Summarize this page over Premium

Confirmed ActiveCredentials for both, using brave://skus-internals

example	example	example	example

ActiveCredentials in brave://skus-internals

VPN	Leo