1474657 - browser.webRequest.getSecurityInfo() returns undefined when called in browser.webRequest.onErrorOccured

Status: NEW

(WebExtensions :: Request Handling, defect, P3)

Description

[April King [:April]]

As far as I can tell, it is not possible to trigger state === "broken" and get the (possibly invalid) certificate chain via browser.webRequest.getSecurityInfo() when an HTTPS error has occurred, without allowing a security exception. This is pretty dangerous behavior to encourage.

I'm not sure exactly what the underlying issue is, but it could be:

* browser.webRequest.getSecurityInfo() can only be called in browser.webRequest.onHeadersReceived, but HTTPS errors trigger the onErrorOccurred event, not onHeadersReceived

* the security information isn't available via the APIs that getSecurityInfo() calls when the browser is in this state

The correct behavior is probably:

1) Allow getSecurityInfo() to be called during onErrorOccurred
2) Return state === "broken"
3) Include a non-internationalized error code alongside the localized error message
4) Include the full certificate chain. Note that this data is generally only available if the error is certificate related, not protocol/cipher related.

Comment 1

[April King [:April]]

I will add that the dev tools *don't* show any information at all if you are stuck at the error page interstitial. Here is what it returns in the security tab for expired.badssl.com:

An error occurred: SEC_ERROR_EXPIRED_CERTIFICATE.

Comment 2

[Kris Maglione [:kmag]]

It's kind of a side-effect of the way that API is implemented. It piggybacks on the channel registration we use for response data filtering, and we clear those registrations when data streaming starts or the channel closes.

Comment 3

[Shane Caraveo (:mixedpuppy)]

I'm going to have to think about how to address this.

Comment 4

[Irene Smith]

Can't write documentation until the issue has been addressed. If it has been addressed elsewhere, can you add a link to the issue?

Please let me know when this is ready to be addressed.

Comment 5

[Shane Caraveo (:mixedpuppy)]

Irene, the doc change that can be done now is to note that getSecurityInfo is currently only available in webRequest.onHeadersReceived.

Comment 6

[April King [:April]]

I believe this is already documented?

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest/getSecurityInfo

Or am I missing something?

Comment 7

[Shane Caraveo (:mixedpuppy)]

Indeed it is. Thanks!