1014414 - Be more verbose as to why the user can't override a "connection is untrusted" dialog.

Status: RESOLVED DUPLICATE of bug 800882

(Core :: Security: PSM, defect)

Description

[Mike Hommey [:glandium]]

+++ This bug was initially created as a clone of Bug #1014387 +++

See bug 1014387 as to how this started.

Considering this is all the result of a combination of how the server is badly configured, and what HSTS tells us, I'm fine-ish with the outcome.

But the "Technical details" could at the very least say why there's no way out, being that the domain requests strict transport security, and where that comes from (the server requesting it or our own preload list)

Comment 1

[Avi Halachmi (:avih)]

If we're talking about the same security exception dialog as the one in bug 659736, then as far as I followed the code (not too closely in these areas) and noticed myself at the actual dialog, it always shows the button and always shows the reason, and differently according to one of the following flags:

WARNING_BAD_CERT_TOP_CONFIRM_ADD_EXCEPTION_FLAG_UNTRUSTED
WARNING_BAD_CERT_TOP_CONFIRM_ADD_EXCEPTION_FLAG_DOMAIN
WARNING_BAD_CERT_TOP_CONFIRM_ADD_EXCEPTION_FLAG_TIME

Comment 2

[Mike Hommey [:glandium]]

Attachment: Screenshot

(In reply to Avi Halachmi (:avih) from comment #1)
> If we're talking about the same security exception dialog as the one in bug
> 659736, then as far as I followed the code (not too closely in these areas)
> and noticed myself at the actual dialog, it always shows the button and
> always shows the reason, (...)

Cf. screenshot, the reason is obscure and doesn't say anything about HSTS, and the button is not there.

Comment 3

[Mike Hommey [:glandium]]

Also, it's not possible to see the certificate and what part of the chain is missing...

Comment 4

[Avi Halachmi (:avih)]

(In reply to Mike Hommey [:glandium] from comment #2)
> Screenshot

Ah, I _think_ that's not considered the exception dialog but rather the exception page/notice, which should hopefully allow you to launch the dialog to view more details, add/confirm an exception for it etc.

While I believe it should use the same kind of flags, I never looked at the code which displays this page.

Also, it does give a reason, at least for the error.

So this bug could be one or several issues:
- incorrect reason
- not high resolution enough reason
- missing reason for not allowing to launch the exception dialog
- not being able to launch the exception dialog

Comment 5

[Avi Halachmi (:avih)]

While bug 659736 is about the dialog itself after it's launched, which has the "confirm" etc buttons disabled, and some related side effect bug where it does show the button and you can confirm the exception, yet you end up again at this error notice/page (from which you could launch the dialog and goto 10).

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks for filing this, Mike. My understanding is bug 800882 aims to do the same thing (unless you're intending that this be for more than just HSTS).