1172234 - HTTPS atom feeds pages are not displayed with certificate and padlock

Status: RESOLVED WORKSFORME

(Firefox :: Address Bar, defect, P5)

Description

[rpnpif]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.7.0
Build ID: 20150513050015

Steps to reproduce:

Visit these sites :
https://fr.wikipedia.org/w/api.php?action=featuredfeed&feed=featured&feedformat=atom
or this :
http://linuxfr.org/news.atom



Actual results:

The certificate is ignored or not recognized. It is not displayed.
The page is wrongly displayed as it is not encrypted.

Other tests :
http://linuxfr.org/nodes/105959/comments/1607268
http://linuxfr.org/nodes/105959/comments/1607269



Expected results:

The certificate should be displayable.
The pad lock should be displayed.
Chromium displayed both the padlock and the certificate.

Comment 1

[rpnpif]

Sorry, but the second test site is https://linuxfr.org/news.atom with https.

Comment 2

[:Gijs (he/him)]

This doesn't need to be security-sensitive.

Comment 3

[Antonio Ospite]

Attachment: firefox_44.0.1_https_feed_2016-02-10 23-27-09.png

Hi, I too am experiencing this with the RSS feed of my own site: https://ao2.it/en/feed

HTTPS works fine for the other contents but apparently it fails for the feed, can this be related to the content type being application/xhtml+xml ?

Please find attached an image which shows how the UI displays the connection status, it is VERY confusing.

There is no mixed content over http and https in this case but Firefox still says "Connection is not Secure".

Even if the communication was actually using HTTPS under the hood, Firefox says "Connection not Encrypted" also in the technical details.

Other browsers do not have this weird behavior, so I guess the server configuration is OK.

Thanks,
   Antonio

Comment 4

[Antonio Ospite]

The issue is still present in Firefox 45

Comment 5

[Antonio Ospite]

The issue is still present in Firefox 46

Comment 6

[Antonio Ospite]

The issue is still present in Firefox 47

Comment 7

[Antonio Ospite]

Still there in Firefox 49.

I know it's a minor issue but it's also kinda weird :)

Comment 8

[Antonio Ospite]

And I verified this happens on Windows too, so the "Platform" field should be updated (I can't do it).

Thanks,
  Antonio

Comment 9

[:Gijs (he/him)]

This is because the content is loaded in a page called about:feeds, and that's what the identity popup uses to make decisions. It no longer has access to the security info of the original https channel, and so it can't tell us anything about the cert or otherwise.

Fixing this would require rearchitecturing the entire rss reader infrastructure, or fetching and keeping a reference to the ssl info somewhere and then plugging it in somewhere else, making sure to throw it away when done because it probably keeps other crap alive so there's a risk of leaks, which is also a lot of work.

RSS is dying and if you open an RSS link the content does not really have a lot of control over what you see (so spoofing risk is pretty minimal), can't run script, and you'll likely have come to the content from another same-domain page. As a result, I don't think this is important and I'm marking as P5, meaning if someone wrote the patch we'd take it, but I and others at Mozilla are unlikely to work on it.

Comment 10

[Antonio Ospite]

Hi Gijs, thanks for the explanation.

I don't know if I'll ever work on that myself, but I was imagining that one possible way to tackle the issue could be to have an option to disable the feed reader altogether and just show the XML content directly from the https URL, with no "special treatment".

What do you think? Would that be less work?

Thanks,
   Antonio

Comment 11

[:Gijs (he/him)]

(In reply to Antonio Ospite from comment #10)
> option to disable the
> feed reader altogether and just show the XML content directly from the https
> URL, with no "special treatment".

You can already configure alternative feed readers, from the web (e.g. yahoo or newsblur or the like) or using an app (e.g. thunderbird).

If we add a separate option to disable the feed reader it will be because we're aiming to remove it completely.

Comment 12

[Antonio Ospite]

(In reply to :Gijs Kruitbosch from comment #11)
> (In reply to Antonio Ospite from comment #10)
> > option to disable the
> > feed reader altogether and just show the XML content directly from the https
> > URL, with no "special treatment".
> 
> You can already configure alternative feed readers, from the web (e.g. yahoo
> or newsblur or the like) or using an app (e.g. thunderbird).
>

Sure, but I was thinking only about resolving the ambiguity in the address bar.

> If we add a separate option to disable the feed reader it will be because
> we're aiming to remove it completely.

I was hinting at that too :)

Thanks,
  Antonio

Comment 13

[u454441]

This bug still exists in Firefox 51.0.1. Source: https://github.com/edavis/hnrss/issues/10

Comment 14

[J.W]

Hi, maybe this bug is also affecting Thunderbird? How can we disable the special treatment without specifying any feed handler, i.e. treat it like a normal webpage?

Comment 15

[:Gijs (he/him)]

Fixed by removing feed preview.