1660945 - HTTPS-Only Mode background HTTP requests reveal sensitive info

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Qwerty]

Attachment: wireshark.png

Bug 1642387 added background HTTP requests to avoid long timeouts when server doesn't response. But those HTTP requests contain path to page, which can be sensitive, making HTTPS-Only Mode less reliable in privacy aspect. Attacker can passively look at those cases even if user doesn't press "Accept the risk and continue", or probably actively filter HTTPS response from server to look at sensitive path in those background requests.

Steps to reproduce:

1. Enable dom.security.https_only_mode in Nightly
2. Enable capturing in wireshark
3. Try to open http://moonlander.seb.ly/sensitive_path
4. Look at wireshark log

Can't those background HTTP requests be targeted to bare domain without path? On top of it, maybe those background requests should be controlled via pref in about:config? Or current state is considered normal for this feature? "Encrypt All Sites Eligible" mode in HTTPS Everywhere extension by EFF seems to not do any HTTP requests before user's action.

Also, I can't test and I'm not sure, but is ESNI case affected by this or not? Because if it is affected, then Firefox should behave differently when it detects ESNI support by domain at DNS lookup stage, not doing any background HTTP request even to bare domain without path, to not leak domain in this case.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Yes, that is a fair point and I think in the majority (if not all) cases sending the request to the bare domain should work. Personally I would like to avoid additional preferences but I understand that in some cases people rather prefer to experience the timeout than leaking information. I'll discuss that with folks in the internal meeting.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Attachment: Bug 1660945 - HTTPS-Only-Mode only send background request to top-level page without path and only if pref is set to true.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c143b57f2a76
HTTPS-Only-Mode only send background request to top-level page without path and only if pref is set to true. r=JulianWels,Gijs

Comment 4

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/c143b57f2a76