1686756 - Insecure downloads with https-only enabled cause zero-byte files to be downloaded.

Status: RESOLVED DUPLICATE of bug 1768854

(Core :: DOM: Security, defect, P3)

Description

[Frank]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:84.0) Gecko/20100101 Firefox/84.0

Steps to reproduce:

Enable http-only mode (dom.security.https_only_mode_ever_enabled)
Navigate to an insecure (http) download link (for example http://speed.hetzner.de/100MB.bin )
Start the download

Actual results:

Firefox will display the proper length of the download and seemingly download the file however it results in a zero byte file

Expected results:

Either an insecure warning should be shown and download halted, or the download should proceed as expected

Comment 1

[Frank]

Erroneously wrote dom.security.https_only_mode_ever_enabled, but meant to say enable https-only mode via dom.security.https_only_mode. Sorry about that.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Julian, can you take a look please?

Comment 4

[Daniel Veditz [:dveditz]]

could it be because of access ranges downloading such a large file? Downloading the file directly as https:// works fine, but http upgraded (which does make a https request according to devtools) doesn't.

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

Leli, adding a ni? so to keep this on your radar!

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Leli is on it!

Comment 7

[Leli]

The download takes more than 3 seconds and is thereby cancelled by the http-background request. --> Bug 1683015

Comment 8

[Leli]

The flag for nsILoadInfo::HTTPS_ONLY_TOP_LEVEL_LOAD_IN_PROGRESS does not get set before dom.security.https_only_mode_send_http_background_request cancels the request

Does work with dom.security.https_only_mode_send_http_background_request false

Comment 22

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:freddy, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 23

[Frederik Braun [:freddy]]

Same as bug 1768854.