1401805 - HTTPS-only domain suggestions are copied as HTTP

Status: RESOLVED WORKSFORME

(Firefox :: Address Bar, defect, P5)

Description

[giul.mus]

Steps to reproduce:

 - Visit an HTTPS-only website, e.g. Mozilla.org. (With `curl -I http://mozilla.org`, you can verify that it redirects to the HTTPS version with HTTP 301 Moved Permanently).
 - In a new tab, start typing "mozilla". The browser should autocomplete to "mozilla.org".
 - Do not press Enter. Rather, select the domain and copy it to the clipboard, either with Ctrl+A Ctrl+C or manually (use the mouse to select the domain, right click, "Copy").
 - Paste the contents of the clipboard somewhere.

Expected results:

The clipboard contains https://mozilla.org/.

What happens instead:

The clipboard contains http://mozilla.org/.

============

For domains that use simple redirection to HTTPS, this is a minor performance issue at best (whoever will click the link will have to wait for the redirect to complete), and a minor privacy/security issue at worst (potentially exposing whoever clicks the link to MITM and protocol downgrade); for sites that use HSTS, it is arguably a violation of the core principle of HSTS (forbid plaintext connections to avoid protocol downgrade attacks).

Comment 1

[Pascal Chevrel:pascalc]

confirmed with Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0 ID:20170920220431

Comment 2

[Marco Bonardo [:mak]]

what you typed is the scheme-less version of mozilla.org, since you didn't confirm the load the browser doesn't know that it's an https only domain.
It's true we could track that internally, but I'm not sure where are we with that work (I think it was named Seer and became the Network Predictor). Regardless is a lot of additional work for a small benefit, since even if you load the scheme-less url, it will go to the secure version per remote settings.

Comment 3

[Marco Bonardo [:mak]]

This is still valid, since we could use the autofill result to set the protocol. still not a priority.

Comment 4

[Florencia Di Ciocco, NI to vbalducci]

Hi, I think that this bug is no longer valid in the face of the latest changes on the browser. If I'm mistaken, please reopen it.
Regards, Flor.