1496634 - changing the location in the urlbar but then clicking away (i.e. not navigating) clears the security indicator

Status: RESOLVED DUPLICATE of bug 1402330

(Firefox :: Site Identity, defect)

Description

[13hu]

Attachment: Bloomberg https page with no security indicator shown

Firefox 62 20180913170256

To reproduce:
 - Loaded an https Bloomberg article URL from a slack-redir link.


Actual results:

The Search icon is shown where the security indicator should be.
Reloading the page showed the secure indicator.

Can't reproduce, but I think I've seen this happen before, very rarely.

Seems like the root cause may be similar to bug 1448424


Expected:

The correct address bar indicator is displayed, secure for https.

Comment 1

[13hu]

Attachment: blogs.microsoft.com search icon instead of https indicator

62.0.3
20181002130007

Happened again on https://blogs.microsoft.com after refreshing the page around 12 times.

Comment 2

[Johann Hofmann [:johannh]]

I can't reproduce this at all. Is this still happening for you? We had a bunch of fixes recently that may have fixed this on the side.

Dana, can you by any chance reproduce this or have an idea what could be the culprit? I feel like this could be a case where we fail to send an onSecurityChange update for some reason, but again, I can't get to reproduce it.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I can't reproduce it either. This may have been fixed by bug 832834 or a follow-up (so the real question is if this reproduces in >= 64).

Comment 4

[13hu]

Attachment: https://ide.kaitai.io No HTTPS indicator FF64

(In reply to Dana Keeler [:keeler] (she/her) (use needinfo) from comment #3)
> I can't reproduce it either. This may have been fixed by bug 832834 or a
> follow-up (so the real question is if this reproduces in >= 64).

Just observed this again in FF64 (Ubuntu).
Refresh restores lock indicator.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Have you been able to figure out more reliable steps to reproduce? Also, do you have any add-ons installed?

Comment 6

[13hu]

(In reply to Dana Keeler [:keeler] (she/her) (use needinfo) from comment #5)
> Have you been able to figure out more reliable steps to reproduce? Also, do
> you have any add-ons installed?


Add-ons:
uBlock Origin
HTTPS Everywhere
Disconnect
webcompat.com Reporter

Sorry I don't have reliable steps to reproduce, I only see this intermittently. In this recent case, the tab was left open but not viewed or accessed for at least 30 minutes.

Comment 7

[13hu]

So it seems like I can reproduce this by pasting something in the address bar after the URL, and then undoing the paste with Ctrl-Z. I can't remember if I've done that every time but that may be the case.

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Oh - I can reproduce that. That would probably be a urlbar issue. Maybe Jared will know where to route this?

Comment 9

[Jared Wein [:jaws] (please needinfo? me)]

Per comment #7, I'm not sure this is really a bug? It is a bit confusing that we color the URL and call out the eTLD like we would do with a URL that has been loaded, but otherwise this is basically how we display the URL when the field is "dirty". Clicking in the field and hitting Escape will put the security indicators back.

Marco, I'm flagging you for needinfo since this is more your area but if comment #7 is the only STR that we know of then I would be fine with wontfix-ing this.

Comment 10

[Marco Bonardo [:mak] (Away Apr 25 - May 5)]

This is (at least) a dupe of bug 1402330, I agree that it's a bit confusing, in practice the urlbar is in edit mode because the value *you* inserted has not been loaded nor confirmed. When the urlbar is in edit mode we only show the magnifier icon.

I'm sure there other bugs around about this, we often discussed of what to do when the urlbar is not focused, whether to restore the actually loaded page url and the confusion that may cause when the user starts editing again if we put back the typed value. It's a mixture of UX and low-sec.