1656027 - Incorrect icon for whitelisted site in HTTPS Only Mode

Status: RESOLVED FIXED

(Firefox :: Site Identity, defect, P3)

Description

[Julian Gaibler]

This bug was initially created as a clone of Bug #1647336, which fixed another issue.

But in the meantime, I was able to track down what is happening.

How to reproduce: Enable HTTPS-Only mode (HOM), visit http://http-login.badssl.com/, and click on "Accept the risk and continue".

Result: The adress-bar icon says the website is a local resource
Expected Results: A "disabled lock" icon should be shown when we are on the content page.

---

Why is this happening, but not always?

Usually, when a user visits a website like http://foo.com, HOM upgrades the connection and URI to https://foo.com. If the error-page shows up, the URI of the page remains https://foo.com and when they click on the "Accept the risk and continue" they get redirected to the HTTP-Version.

Sometimes, websites have a valid certificate to redirect users back to the HTTP version which causes a redirect loop. The error page shows up again, but the URI will be http://foo.com (because the loop ends on an uneven number). When the user now clicks on "Accept the risk and continue" they, again, get redirected to the HTTP-page. But because the URI spec of the error page and the loaded page are the same, part of the UI code determines to only "refresh the IdentityBlock" instead of "updating it".

When the IdentityBlock is only "refreshed", the code doesn't check that we left the secure context of the error page and entered the insecure context of the actual site. That's why the wrong icon shows up.

Comment 1

[Julian Gaibler]

Attachment: Bug 1656027 - Added cached property 'isSecureContext' as an additional condition when the security UI should be updated.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1570678

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/796a95f974b6
Added cached property 'isSecureContext' as an additional condition when the security UI should be updated. r=pbz

Comment 4

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/796a95f974b6