1294708 - [h2] HTTP2 INADEQUATE_SECURITY error messages could use more detail

Status: NEW

(Core :: Networking: HTTP, defect, P3)

Description

[Boris Zbarsky [:bzbarsky]]

The string says "Error code: NS_ERROR_NET_INADEQUATE_SECURITY" but that doesn't tell people to go look up HTTP/2 INADEQUATE_SECURITY.

This was reported in bug 1122642 comment 25 which has more details (including some information about us and Chrome having different behavior which may be worth looking into).

Nick, can you take a look, please?

Comment 1

[Boris Zbarsky [:bzbarsky]]

Note that the above linked comment suggests actually showing the blacklisted cipher that was negotiated...

Comment 2

[u408661]

There was another bug reported where chrome would talk to a misconfigured server (nginx?) that we didn't (chrome is in the wrong there) and fixing the cipher suite selection server-side made everything work. So that's that part of the comment. Unfortunately, my bugzilla-fu is failing to find that bug.

I'll think about the wording of the error page and see if I can come up with something more useful.

Comment 3

[Boris Zbarsky [:bzbarsky]]

> chrome is in the wrong there

Did we get a bug filed on them?

Comment 4

[u408661]

(In reply to Boris Zbarsky [:bz] (Vacation until Aug 21) from comment #3)
> > chrome is in the wrong there
> 
> Did we get a bug filed on them?

That's a good question, if I could find our bug I could answer it :) Maybe Patrick can remember the bug I'm talking about (or otherwise set me straight). Of course, he's not accept ni?s right now, so I'll email him and he can respond when he's back.

Comment 5

[nikola.kovacs]

> chrome is in the wrong there

Is it? The RFC says the endpoint MAY choose to generate a connection error: https://tools.ietf.org/html/rfc7540#section-9.2.2

Comment 6

[Patrick McManus [:mcmanus]]

(In reply to nikola.kovacs from comment #5)
> > chrome is in the wrong there
> 
> Is it? The RFC says the endpoint MAY choose to generate a connection error:
> https://tools.ietf.org/html/rfc7540#section-9.2.2

I need to lookup the contents of the bug to see if that was the issue (I think the issue was fuzzy iirc and became worksforme before getting down to a root cause), but chrome certainly does not intend to work with blacklisted suites nor does firefox.

I changed the triage on this.. nick if you've got a patch in progress feel free to change it back

Comment 7

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 8

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258