1425211 - Ghost connections to corp. Citrix XenApp but NO related tab open

Status: RESOLVED DUPLICATE of bug 1411637

(Firefox :: New Tab Page, defect)

Description

[tok]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20171128222554

Steps to reproduce:

Context: Using Firefox, I access my company's Citrix XenApp web portal. After 2FA authentication, several applications are presented and I can launch e.g. a desktop session using the standalone Citrix Receiver application. This works all fine.

However, while NOT using the portal at all, both on startup + recurringly Firefox automatically establishes connections to this web site altough I have no associated tab open.


Actual results:

I have noticed that Firefox initiates connections to the mentioned web portal both on startup of Firefox as well as irregularly--but without any related open tab! i.e. I am not using the Citrix portal in any way and do not have it opened in any tab but Firefox still connects there automatically and recurringly.

I was able to reproduce the behaviour by creating a second user profile. As soon I have visited the Citrix portal ONCE (not even logged in) and closed the tab, Firefox still connects there after relaunch.

Did some network exploration: 20-30 connections are made over a period of approx. 90 seconds, 9 MB are sent, 2MB received. This repeats after 7min without using Firefox at all.
Traffic is all TLS, so I started up Burp Proxy: Firefox performs approx. 300 identical GET requests to /Citrix/XenApp/auth/silentDetection.aspx and receives 300 times the same web site data.


Expected results:

Seems super fishy to me--why should Firefox perform such queries, when there is no related tab? Makes no sense to me.

Comment 1

[Kershaw Chang [:kershaw]]

I think this could be the service about taking thumbnail for the new tab page in the background.

Could you try to:
1. Open a new tab (by pressing Ctrl-T or typing about:newtab in the location bar).
2. Click on the settings button on the top right of the page, and select "Show blank page".
3. See if you can reproduce this again.

Thanks.

Comment 2

[tok]

Thank you for your idea. Unfortunately, it was not the root cause as I already have a blank new tab page (although I do not have the option "Show blank page" but can only deselect search, most visited, etc. which was already the case). So it occurs in both situations, blank new tab in my main profile and default new tab in test profile.

Just to rule this one out, I deactivated the parameters browser.newtabpage.enabled, browser.newtabpage.enhanced and browser.newtab.preload but without success. On every browser restart, Firefox makes connections as described.

Best regards

Comment 3

[tok]

Attachment: screenshot connections

Screenshot of Little Snitch Firewall, showing the connections to the Citrix portal. Between each block, Firefox was restarted. "firefox-bin" because I started it directly with an alternate profile via -P.

Comment 4

[tok]

Attachment: Burp proxy screenshot

TLS interception with Burp proxy, showing connections. Same request repeats ~300 times.

Comment 5

[Kershaw Chang [:kershaw]]

(In reply to tok from comment #2)
> Thank you for your idea. Unfortunately, it was not the root cause as I
> already have a blank new tab page (although I do not have the option "Show
> blank page" but can only deselect search, most visited, etc. which was
> already the case). So it occurs in both situations, blank new tab in my main
> profile and default new tab in test profile.
> 
Even if you deselect "Top Sites", firefox still tries to capture thumbnails in background.

Could you try adding "browser.pagethumbnails.capturing_disabled", setting to true, restarting the browser, and try to reproduce again?

Thanks.

Comment 6

[tok]

browser.pagethumbnails.capturing_disabled did the trick, no more connections to the Citrix portal, neither on startup nor recurringly.

I would expect Firefox not to capture thumbnails at all if Top Sites are disabled. Apart from this, it seems to be a bug to perform so many requests just for a thumbnail.

Thank you very much!

Comment 7

[Kershaw Chang [:kershaw]]

(In reply to tok from comment #6)
> browser.pagethumbnails.capturing_disabled did the trick, no more connections
> to the Citrix portal, neither on startup nor recurringly.
> 
> I would expect Firefox not to capture thumbnails at all if Top Sites are
> disabled. Apart from this, it seems to be a bug to perform so many requests
> just for a thumbnail.
> 

I'd like to change the component to "Activity Streams" and let other guys answer your question.
Thanks.