Unable to login https://account.t-mobile.com/

[ryanbr]

Description

Unable to login into https://account.t-mobile.com/ due to fingerprinting.

Steps to Reproduce

1. Open https://account.t-mobile.com/
2. Get a error message
3. Unable to login

Actual result:

Expected result:

Allow user to login

Reproduces how often:

With a US login, reproducible with fingerprinting enabled

Version/Channel Information:

• Can you reproduce this issue with the current release? Yes
• Can you reproduce this issue with the beta channel? Yes
• Can you reproduce this issue with the nightly channel? Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? Yes
• Does the issue resolve itself when disabling Brave Rewards?
• Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

Debuging with @okidokiokami Disabling Language fingerprinting resolves this issue.

cc: @pilgrim-brave

[pilgrim-brave]

reproduced

[pilgrim-brave]

During authentication flow, site makes an XHR request to /eui/v1/initSession with an explicit Accept-Language: en header, which we are overwriting with Accept-Language: en-US,en;q=0.8, which causes the server to return an HTTP error 400.

[pilgrim-brave]

Overwrite is intentional and occurs here: https://github.com/brave/brave-core/blob/master/browser/net/brave_reduce_language_network_delegate_helper.cc#L106

But for XHRs where the page script has explicitly set an Accept-Language header, we should leave it alone instead of farbling it.

[pilgrim-brave]

By "intentional" I mean Brave is doing what we designed it to do. It just needs to do something else (in limited circumstances).

[Uni-verse]

Verified on Android and MacOS per brave/brave-core#17549 (comment)

[kjozwiak]

Removing QA Pass labels as the verifications via brave/brave-core#17549 (comment) were used to check that the above was working as expected before uplifting into 1.50.x via brave/brave-core#17697. Once this lands in 1.50.x and we get builds, we can verify and add the appropriate labels.

[kjozwiak]

The above requires 1.50.110 or higher for 1.50.x verification 👍

[Uni-verse]

Verified using version:

Brave	1.50.112 Chromium: 112.0.5615.49 (Official Build) (x86_64)
Revision	bd2a7bcb881c11e8cfe3078709382934e3916914-refs/branch-heads/5615@{#936}
OS	macOS Version 12.6 (Build 21G115)

• Ensured user is able to login to account.t-mobile.com and view the dashboard

[Uni-verse]

Verified on Samsung GS 21 using the following version:

Brave	1.50.113 Chromium: 112.0.5615.49 (Official Build) (64-bit) 
Revision	bd2a7bcb881c11e8cfe3078709382934e3916914-refs/branch-heads/5615@{#936}
OS	Android 13;

Using STR in #28945 (comment)

• Confirmed user is able to log into https://account.t-mobile.com and view dashboard