1331224 - Spurious insecure password warning on Bugzilla

Status: RESOLVED DUPLICATE of bug 1329940

(Toolkit :: Password Manager, defect)

Description

[Eric Rescorla (:ekr)]

Attachment: Screen Shot 2017-01-14 at 5.34.19 PM.png

Comment 1

[Eric Rescorla (:ekr)]

Attachment: Screen Shot 2017-01-14 at 5.36.16 PM.png

Comment 2

[Eric Rescorla (:ekr)]

P.S. This was Nightly

Comment 3

[Matthew N. [:MattN]]

From the screenshot I can see you were on enter_bug.cgi, what linked you to this page? If it was an insecure site then window.opener could have been insecure and this would be a dupe of bug 1329940.

Comment 4

[Eric Rescorla (:ekr)]

I went to b.m.o and clicked "new".

Unfortunately, I can't repro it.

Comment 5

[Tanvi Vyas[:tanvi]]

I don't know why bugzilla.mozilla.org wouldn't be a secure context, but given this intermittent bug and others, I think we should switch to a more naive approach (isOriginPotentiallyTrustworthy) instead of using isSecureContext.  See bug https://bugzilla.mozilla.org/show_bug.cgi?id=1329940.  We can use isSecureContext in Nightly and debug issues and reports that come up there, until we are satisfied enough to use it in release.

Comment 6

[Matthew N. [:MattN]]

(In reply to Tanvi Vyas - behind on bugmail [:tanvi] from comment #5)
> I don't know why bugzilla.mozilla.org wouldn't be a secure context, but
> given this intermittent bug and others, I think we should switch to a more
> naive approach (isOriginPotentiallyTrustworthy) instead of using
> isSecureContext.  See bug
> https://bugzilla.mozilla.org/show_bug.cgi?id=1329940.  We can use
> isSecureContext in Nightly and debug issues and reports that come up there,
> until we are satisfied enough to use it in release.

I don't have any reason to think this isn't caused by window.opener and therefore a dupe of bug 1329940. When the problem occurs we need to see the web console output for window.opener. In case you didn't know window.opener persists across top-level cross-origin loads so likely the tab in the screenshot was originally opened from an insecure context.

Comment 7

[Matthew N. [:MattN]]

Duping to bug 1329940. Re-open if you can show that window.opener in your web console is secure.