1653898 - Sometimes HTTPS Only Mode works if you add "www"

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Arthur Edelstein [:arthur]]

speedofanimals.com is an example. With HTTPS-Only Mode enabled, if I enter
http://speedofanimals.com
in the address bar then we experience a long timeout (90s). But if I enter
http://www.speedofanimals.com
then it upgrades to https://www.speedofanimals.com and the site immediately loads.

Here's an idea to fix this problem: if the browser is trying to load an HTTP URL with domain "foo.example" and that is failing to upgrade, could we try "https://www.foo.example/..." in the background?

(This behavior could be controlled by the existing prefs
browser.fixup.alternate.enabled and browser.fixup.alternate.prefix.)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

FWIW, the approach for fixing this is problem is very similar to Bug 1658924. In detail what we would need to do is:

• Within DocumentLoadistener::Cancel() check if the error is an https-only-error, if so, we could then
• call something similar to MaybeHandleLoadErrorWithURIFixup where we would take the current URI and add www and instead of actually cancelling the load we would call bc->LoadURI(newURIWIthwwwAdded)
• if that load then fails we would go back to displaying the error page as we would have done in the first place.

Downside here is that that we would increase load time before displaying an error page. Consider the following example:

• User wants to visit foo.com -> connection would time out, so 3 seconds (+ roundtrip time) our shortening approach would call ::Cancel()
• The mechanism in this bug detects there is no www so we would add that and start the load again
• Again 3 seconds later (+ roundtrip time from the background channel) we would detect that adding www also doesn't allow to connect using https.
• Finally we display the error page but the user has already waited for more than 6 seconds.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

I was made aware that Firefox already supports redirecting to www, even though currently behind a pref, the Bug implementing that is Bug 1617987. I haven't tested if it works with HTTPS feature enabled, but it's probably wise doing before moving foward with this bug. It seems the pref is security.bad_cert_domain_error.url_fix_enabled.

Comment 3

[Julian Gaibler]

Also, to add to the downsides, the error page will be for www.foo.com instead of foo.com, which might cause other issues.

Comment 5

[Arthur Edelstein [:arthur]]

Another example of this: http://barnesandnoble.com

Comment 8

[Martin Thomson [:mt:]]

I think that this is down to different redirect behaviour on the different domains.

http://www.tzi.de/~cabo/ is another example. That works, but http://tzi.de/~cabo/ does not, unless you disable HTTPS-Only.