1475450 - HSTS preload in version 61 prevents non-https connections to server name "new"

Status: RESOLVED INVALID

(Core :: Networking: HTTP, defect)

Description

[casey.moore]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.183 Safari/537.36 Vivaldi/1.96.1147.47

Steps to reproduce:

Attempt to navigate to an intranet site that does not support HTTPS by entering HTTP://new/ into URL bar.


Actual results:

HSTS preload defined by transport_security_state_static.json line

{ "name": "new", "policy": "public-suffix", "mode": "force-https", "include_subdomains": true },

 attempts to internally  redirect "new" to https


Expected results:

Webpage should have loaded my intranet page via HTTP not HTTPS

Comment 1

[u554753]

I can reproduce this with the following specs:
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0
Build ID: 20180718100918

But I'm also not certain if this behavior is intentional or not.

Comment 2

[Valentin Gosu [:valentin] {{ PTO 3 July - 3 August }}]

This is expected behaviour. I think we got a few other reports related to this.

Here's a resource regarding the topic:
https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/

There's also the network.stricttransportsecurity.preloadlist pref, which may be used to disable the preload list (though I haven't checked if it works).