87182 - Browser doesn't recognize site as secure this case

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P1)

Description

[scalkins]

Saw this all platforms:
Win32 2001-06-21-06 trunk
Linux 2001-06-20-21 trunk
Mac 2001-06-21-08 trunk

Stesp to repro:
1)Launch browser
2)Go to http://www.etrade.com
3)Click on "Banking" tab on web page
4)Click on the yellow "Log On" button at upper left of resulting Page for
banking tab.

Actual results: The lock icon at the lower right orf the browser stays unlocked,
implying an insecure connection. Note however that the URL bar shows the
https:// in the front indicating a secure site. I am afraid to submit a password
here for this reason, so this is dogfood for this use for me!
The console seems to think it's not a secure site either, as it references the
URLs as follows using steps in test case:

Document http://www.etrade.com/ loaded successfully
Document http://www.etrade.com/cgi-bin/gx.cgi/Applogic+TBHome loaded successfull
y
Document http://www.etradebank.com/logon.cfm loaded successfully

Note that the URL bar in the browser itself shows the URL
https://trading.etrade.com/cgi-bin/gx.cgi/applogic+tbbanktobrkg?appname=loginpage
for step #4 of the test case.

Expected results: The lock icon at the lower right of the browser engages and
turns yellow to indicate a secure site

Comment 1

[scalkins]

Nominating nsbranch.I am afraid to do online banking at this site with NS 6 till
this is fixed.

Another Note: If I go to www.etrade.com and then click directly on the Log ON
icon before going to the Banking tab, it looks like it's seen as secure (Yellow
locked lock on browser, and correct https url seen in console as well as browser)

Comment 2

[Mitchell Stoltz (not reading bugmail)]

->Crypto. Lock icon problems again?

Comment 3

[John Unruh]

PSM

Comment 4

[Bob Lord]

Possibly a dup of bug 82437

Setting Target to 2.0.

Comment 5

[David P. Drinan]

The problem is a http redirect to https. The PSM lock icon state machine is 
getting confused. I'll post a patch soon.

Comment 6

[David P. Drinan]

Attachment: Patch. Javi, please review.

Comment 7

[Javier Delgadillo]

r=javi

Comment 8

[David P. Drinan]

Adding blizzard to cc-list.

Chris,

Please super-review. Also, this fix should be considered for the 0.9.2 branch 
since it fixes up a bunch of lock icon failures.

Comment 9

[Stephane Saux]

Steve, need approval for 0.9.2

Comment 10

[David Hyatt]

sr=hyatt.

Comment 11

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to 0.9.2 branch.
(on behalf of drivers)

Comment 12

[David P. Drinan]

Checked onto trunk and branch. Marking FIXED.

Comment 13

[David P. Drinan]

-> FIXED.

Comment 14

[John Unruh]

Verified.