1519723 - view-source https page missing secure indicator in address bar

Status: RESOLVED DUPLICATE of bug 1496844

(Firefox :: Security, defect)

Description

[13hu]

FF64 Ubuntu
view-source:https://www.mozilla.org/firefox/

The secure lock icon is not displayed in the address bar, but clicking the info icon shows "Secure Connection"

Expected: secure indicator shown in address bar as normal

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

This might be the intended behavior (although if so, we're inconsistent on FF for Android, because that shows the lock). gIdentityHandler.refreshIdentityBlock() checks against _uriHasHost, which will get set in setURI. Since a "view-source" URI doesn't have a host field, _uriHasHost will be false (even though nsSecureBrowserUIImpl does provide a secInfo). Johann, thoughts?

Comment 2

[Johann Hofmann [:johannh]]

Interestingly this is a dupe for a bug you filed already. :)

To be honest I don't have a strong preference here. Off-hand I wouldn't see any security risk in showing the secure indicators for view-source, but it's not exactly a priority either. I would certainly take a patch.

Comment 3

[Jawad Ahmed [:jawad]]

Attachment: Bug 1496844 - view-source https page missing secure indicator in address bar. r=johannh

Comment 4

[Phabricator Automation]

Comment on attachment 9050445 [details]
Bug 1496844 - view-source https page missing secure indicator in address bar. r=johannh

Revision D23214 was moved to bug 1496844. Setting attachment 9050445 [details] to obsolete.