1431043 - webRequest.onHeadersReceived cannot trigger HSTS on cached requests

Status: REOPENED

(WebExtensions :: Request Handling, defect, P3)

Description

[Wladimir Palant]

+++ This bug was initially created as a clone of Bug #1418275 +++

With bug 1418275 fixed, I am still stuck with Enforce Encryption encryption. In order to enable HSTS my extension triggers a request with `cache: "force-cache"` flag - having it hit the network is really undesirable. It then does the following in the onHeadersReceived handler:

      let headers = details.responseHeaders || [];
      headers.push({
        name: "Strict-Transport-Security",
        value: "max-age=31536000000"
      });
      return {responseHeaders: headers};

This works in Chrome, the site gets HSTS enabled as the result. In Firefox (tested in 59.0a1 2018-01-15 nightly) it has no effect for cached requests however. Looking into the source code, it seems that no HSTS processing happens for cached requests. This seems wrong: even a cached response should renew HSTS if it happened to expire in the meantime (yes, this is quite some edge case).

Comment 1

[Wladimir Palant]

It should say "Enforce Encryption extension" in the previous post of course.

Comment 3

[Shane Caraveo (:mixedpuppy)]

Actually I wanted to keep this open to keep it in a bug list under webextensions (and thus on my radar)

Comment 4

[Shane Caraveo (:mixedpuppy)]

moving to p3 due to external team dependency.