133455 - https->http: password dlg before security warning.

Status: RESOLVED DUPLICATE of bug 62178

(Core :: DOM: Navigation, defect)

Description

[Aleksey Nogin]

reproducible: have not tried yet.

1) Go to some https page
2) Go to password-protected http url

Expected: security warning pops up before anything interesting happens.
Actual: password dialog is shown first, only afterwards Mozilla warns me that
the password was just transmitted in the clear...

BuildId 2002032109 on RedHat Linux 7.2

Comment 1

[Mitchell Stoltz (not reading bugmail)]

->Networking

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Let's try that again...

Comment 3

[Darin Fisher]

interesting bug... it probably means that whoever is issuing those warnings
isn't doing it until HTTP sends out an OnStartRequest.... seems like they should
do it once a non-HTTPS URL is requested.

i'm not sure who owns that dialog...

-> docshell (perhaps?)

Comment 4

[Aleksey Nogin]

In Netscape 4 the warning dlg used to appear before the insecure page starts
loading. In Mozilla it seems that it only appears when the insecure page
finishes loading.

Comment 5

[Darin Fisher]

cc'ing some security folks... they'd know where these dialogs hook in and would
probably want to own this bug.

Comment 6

[Kai Engert (:KaiE:)]

We need to fix 62178, and this issue will then be fixed, too.

Allowing people to cancel the request also means, that the future warning will
fire up early enough in the process, to guarantee that the warning will be shown
before any data gets transferred.

The current behaviour of the security warnings is doing it very late. It reacts
on page load progress events, which are sent out after the transfer has started.


*** This bug has been marked as a duplicate of 62178 ***