1293065 - sign in page not secured with https!

Status: RESOLVED DUPLICATE of bug 983326

(Core :: DOM: Security, defect)

Description

[sadatsa129]

Attachment: mozilla.png

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0
Build ID: 20160728203720

Steps to reproduce:

1. opened Firefox browser
2. clicked sync now from tools 
3. this page request to sign in/ sign up
4. sign in page 
5. not secured with https


Actual results:

the sign in page wasn't secured with https. 


Expected results:

this page should be secured with https as this is a login page.

Comment 1

[sadatsa129]

as I'm new in bugzilla so I didn.t understand the meaning of "Component: Untriaged → Sync" . can you please explain?

Comment 2

[Matt Wobensmith [:mwobensmith][:matt:]]

(In reply to sadatsa129 from comment #1)
> as I'm new in bugzilla so I didn.t understand the meaning of "Component:
> Untriaged → Sync" . can you please explain?

Your bug was placed into the proper category so that the right people will see it.

Comment 3

[Daniel Veditz [:dveditz]]

Tanvi: does this have the same underlying cause as bug 1293476?

sadasta: The sync sign-in page in your screenshot is a built-in browser page (as shown by the Firefox icon and text to the left of the URL, and true for most "about:" urls). It's not actually mixed content and the password is not sent insecurely. This is a bug that mistakenly categorizes about: pages as "insecure" when they are, in fact, local content just like file:/// urls.

Comment 4

[Tanvi Vyas[:tanvi]]

We send this warning to the webconsole in this code[1].  It checks for a secure top level using LoginManagerContent.isDocumentSecure.  isDocumentSecure calls isOriginPotentiallyTrustworthy[2].  isOriginPotentiallyTrustworthy doesn't check URI flags and it doesn't whitelist the about: scheme[3].

Looks like this bug was filed a while back - https://bugzilla.mozilla.org/show_bug.cgi?id=1221771 - and was apparently fixed at one point.

isOriginPotentiallyTrustworthy needs to start to use URI flags.

[1] https://dxr.mozilla.org/mozilla-central/source/toolkit/components/passwordmgr/InsecurePasswordUtils.jsm#76

[2] https://dxr.mozilla.org/mozilla-central/source/toolkit/components/passwordmgr/LoginManagerContent.jsm#1246

[3]https://dxr.mozilla.org/mozilla-central/source/dom/security/nsContentSecurityManager.cpp#600

Comment 5

[Daniel Veditz [:dveditz]]

This is broken UI (scaring users), but there's no actual security problem.