1000151 - EV indicator stops appearing after restart (even without session restore)

Status: RESOLVED DUPLICATE of bug 995801

(Core :: DOM: Security, defect)

Description

[Gian-Carlo Pascutto [:gcp]]

Related to bug 995801.

STR:

1) *Disable* session restore.
2) Start Firefox session with default or empty homepage.
3) type op.fi in the address bar (This is a Finnish bank AFAIK)
4) Repeat 1-3 a few times.
5) Notice the EV indicator disappears.

Restarting Firefox never makes it come back. The only "fix" I found was to clear the disk cache.

Comment 1

[Gian-Carlo Pascutto [:gcp]]

FWIW the person who reported me was seeing this on Firefox 28 so updating flags accordingly.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

All versions of Firefox across platforms starting with 29.0 are affected by that. I certainly think this should block the release of 29.0.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #1)
> FWIW the person who reported me was seeing this on Firefox 28 so updating
> flags accordingly.

It only seems to happen in Firefox 28.0 when at least a 29.0 version was running before, which put the profile into that bad state.

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Maybe he/she was right. I need at least a restart in between with session store disabled, to see this problem. I wonder if the underlying issue is still the same as on bug 995801.

Comment 5

[Gian-Carlo Pascutto [:gcp]]

dkeeler said in that bug: "In particular, revocation information is not persistently cached (yet - we're working on it), so when loading a page from the cache at startup, an EV site may be presented as non-EV until a network request is made to that site"

However, that diagnosis doesn't look like it can be (entirely) correct for this bug. I mean, how can we not establish a network request to the site with the given STR?

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Have you actually tested the steps in comment 0? I accidentally did this on a profile which I was using for the other bug. :/ So that's why I see it. When I use a really blank profile, I can load the page dozen of times without seeing this issue. I really have to restart Firefox, to trap into it. Further reloads do not change the broken behavior so I never see the EV cert again.

Comment 7

[Gian-Carlo Pascutto [:gcp]]

It wasn't a blank profile, but IIRC it hadn't been used for the other bug either. I certainly never visited that site before, and I have no reason to believe the person who was reporting this to me would ever have seen the other bug.

>I really have to restart Firefox, to trap into it. 

Yes, you need to restart, not just reload the page. (I should have said, repeat 2-3, and maybe make it more clear that step 2 involves closing and reopening the browser)

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

In that case this issue is really the same as bug 995801. I have tested the regression range as given on bug 995801 comment 12, and it is identical on OS X. I think we should continue on bug 995801.