Bugzilla

I'm not sure this is a simple bug, it seems there are a number of corner cases here.

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #3)
> Currently if the top-level document got exempt from https-only, then we set the flag `HTTPS_ONLY_EXEMPT` on the loadinfo for any resource loads. So I assume we are missing that somewhere for extension triggered loads.

So the exempt flag is set for the document in the tab, but extension is probably doing loads from their background page.

Background page is not visible in browser's UI, so there's no way for users to grant an exemption to extensions.

Also, lots of extensions have iframes that (potentially) load HTTP pages, and it seems there's no way to exempt those either.  Clicking "Continue to HTTP site" in the iframe doesn't work, and there's nothing in the page info panel to exempt for the whole page.

Additionally, we don't expose the exemption status to extensions, or the HTTPS_ONLY status in the first place, so developers can't know what pages/domains are valid via http.

I'm not sure this is a simple bug, it seems there are a number of corner cases here.

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #3)
> Currently if the top-level document got exempt from https-only, then we set the flag `HTTPS_ONLY_EXEMPT` on the loadinfo for any resource loads. So I assume we are missing that somewhere for extension triggered loads.

So the exempt flag is set for the document in the tab, but extension is probably doing loads from their background page.

Background page is not visible in browser's UI, so there's no way for users to grant an exemption to extensions.

Also, lots of extensions have iframes that load (potentially) HTTP pages, and it seems there's no way to exempt those either.  Clicking "Continue to HTTP site" in the iframe doesn't work, and there's nothing in the page info panel to exempt for the whole page.

Additionally, we don't expose the exemption status to extensions, or the HTTPS_ONLY status in the first place, so developers can't know what pages/domains are valid via http.