1647033 - Redirects to different subdomains can cause multiple error pages in https only mode

Status: NEW

(Core :: DOM: Security, defect, P3)

Description

[Arthur Edelstein [:arthur]]

To reproduce:

1. Set dom.security.https_only_mode to true
2. go to http://neverssl.com

Results:

1. We see an error page for https://neverssl.com/
2. After clicking "continue" we then see an error page for https://kbcnhfdlmzrwsvxt.neverssl.com/online
3. After clicking "continue" a second time, we see the content of the site.

Expected results:
We should expect to see only one error page.

Possible solution: index the https-only-mode whitelist to eTLD+1.

Comment 1

[Malte Jürgens [:maltejur]]

Attachment: WIP: Bug 1647033 - Set HTTPS-Only Exceptions for Effective Site (eTLD+1) r?freddyb

Comment 2

[Malte Jürgens [:maltejur]]

After talking to Freddy about this again, we have decided to leave this as it is right now, because setting the exceptions to the eTLD+1 would introduce a lot of new problems and edgecases as we would probably still want to keep the per-origin exceptions, and even undesirable behaviour in regards of setting an exception for the whole site, while the user only wants it for the subdomain. Still leaving this open, as those multiple HTTPS-Only error pages are still an annoyance.