1638896 - Firefox displays incorrect address & certificate

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Takashi]

Firefox version: Firefox 76.0.1

OS: MacOS catalina 10.15.4

While I am browsing https://tangi.co/playbook/, I noticed Firefox displays wrong address & certificate.

Step to reproduce:

1. Go to https://tangi.co/playbook/

2. Click LINK "Mask Making Supplies"

3. Google redirect warning massage will displayed, click URL that goes to https://www.joann.com

Result: Browser’s address bar displays https://tangi.co/playbook/ while contents served from https://www.joann.com

Video demo: https://drive.google.com/open?id=16W06ECvWV-kEq5myjLDUIg9ShkIyQr0D

Comment 1

[:Gijs (he/him)]

(In reply to Takashi from comment #0)

While I am browsing https://tangi.co/playbook/, I noticed Firefox displays wrong address & certificate.

"Not available in your region".

Do you have a reduced testcase, or information where the testcase does work?

Comment 2

[:Gijs (he/him)]

And can you reproduce in nightly ( https://nightly.mozilla.org/ ) and/or on a clean profile on release?

Comment 3

[Takashi]

Yes. I can produce on nightly after I cleared all of history. To admit, I am not sure what the route cause is… but address bar is showing different address…

Could you please try VPN to change IP address if you still blocked from tangi? I am accessing from Japan.

Comment 4

[Takashi]

(In reply to :Gijs (he/him) from comment #1)

Could you please try this step?

1. Go to https://tangi.co/

2. You will see message like "Join this challenge by applying to be a creator..." on page, Click link "challenge" witch goes to https://tangi.co/playbook/

3. Click link "Mask Making Supplies"

4. Google redirect warning massage will displayed, click URL that goes to https://www.joann.com

Video demo on nightly: https://drive.google.com/open?id=1D9yHg0VCgK6N-xMGfmbFfcASLO02Ka9u

Comment 5

[Takashi]

Could you please close this ticket? It appears my mistake

On https://tangi.co/playbook/, the visible contents are actually inside an iframe (you can check by inspecting the page contents in Dev Tools). When you click the link, it is loading inside that iframe not as a top-level navigation. This ends up loading the Joann site contents inside the iframe. This is expected behavior of iframes. If Joann.com does not want to be loaded inside iframes (for example, for their login page) they should use the HTTP x-frame-options header [1] to prohibit framing those pages

Comment 6

[:Gijs (he/him)]

Thanks for the quick update!