151250 - False warning posting to https site from http site.

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P3)

Description

[vikingB]

If you have a page on a http site that has a form pointing to an https site, the
browser still complains that the traffic is not being encrypted and might be in
the clear. 

I am assuming this is a bug unless there is a cache of the values on the http
side page.

Comment 1

[Matthias Versen [:Matti]]

-> PSM

Build ID ?

Comment 2

[John Unruh]

Works for me. I don't get a warning when logging into yahoo mail. 
http://mail.yahoo.com, and it is posting to an https site.

Comment 3

[vikingB]

Hit up URL http://www.911lifelink.com/accept.html click "I accept"

Comment 4

[John Unruh]

Confirming on trunk Win2000 and Mac OSX. Adding URL and changing summary from 
"browser doesn't notice post to https site"

Comment 5

[Kai Engert [:KaiE:]]

Let's define "formSecure" as the bool indicating whether the page containing the
form is secure or not. The case described in this bug is "formSecure false".

Let's define "actionSecure" as the bool indicating whether the destination URL,
where the form data will be sent to, is secure or not. The case described in
this bug is "actionSecure true".

Here is the current logic as defined by the browser:


actionSecure && formSecure => no warning shown

!actionSecure && formSecure => Warning "Post To Insecure From Secure"

!actionSecure && !formSecure => Warning "Post To Insecure"

actionSecure && !formSecure => Warning "Post To Insecure"


The text of the message clearly says "you are posting TO an insecure page".
Because of that, I would assume the case mentioned in this bug was simply forgotten.

Spontaneously I'm tempted to suggest to change the case
  actionSecure && !formSecure => no warning shown
as this bug requests.


But on the other hand, why is mail.yahoo.com already working?

I would like to understand that better and will have a deeper look.

Comment 6

[Kai Engert [:KaiE:]]

-> me

Comment 7

[Kai Engert [:KaiE:]]

Update on the Yahoo behaviour: It is using a trick. It is not finishing the
submit, but cancels it. Then it uses JavaScript to load the next page, manually
passing on the data entered in the form.

Comment 8

[Kai Engert [:KaiE:]]

Attachment: Patch v1

With this patch, no warning is shown if the action URL is secure - no matter
the form page is secure or not.

Comment 9

[Kai Engert [:KaiE:]]

Javi, can you please review?

Comment 10

[Kai Engert [:KaiE:]]

Updating URL to http://www.kuix.de/misc/test29/
Page can be used to test all combinations.

Comment 11

[Javier Delgadillo]

Comment on attachment 91094 [details] [diff] [review]
Patch v1

r=javi

Comment 12

[Kai Engert [:KaiE:]]

Alec, can you please review?

Comment 13

[Alec Flett]

Comment on attachment 91094 [details] [diff] [review]
Patch v1

sr=alecf

good to see ample comments!

Comment 14

[Asa Dotzler [:asa]]

Comment on attachment 91094 [details] [diff] [review]
Patch v1

a=asa (on behalf of drivers) for checkin to the 1.1 trunk.

Comment 15

[Kai Engert [:KaiE:]]

Checked in to trunk.

Comment 16

[John Unruh]

Verified on Win32 7/116 trunk.

Comment 17

[Matthias Versen [:Matti]]

*** Bug 157841 has been marked as a duplicate of this bug. ***

Comment 18

[John Unruh]

Verified.

Comment 19

[Kai Engert [:KaiE:]]

*** Bug 182179 has been marked as a duplicate of this bug. ***

Comment 20

[bmartin]

Verified on the branch 2003-02-10-09

Testing latest branch 2002-02-10-09 on Win2000

go to http://www.911lifelink.com/accept.html , select "I Accept" results in the
following security warning dialog: "Security Warning - You have requested an
encrypted page. The web site has identified itself correctly, and information
you see or enter on this page can't easily be read by a third party. [OK]"

This is the expected behavior