Closed Bug 1691888 Opened 3 years ago Closed 3 years ago

HTTPS-Only mode gets stuck in a loop if website uses a HTTPS meta refresh to redirect to HTTP

Categories

(Core :: DOM: Security, defect, P3)

Firefox 87
defect

Tracking

()

RESOLVED FIXED
88 Branch
Tracking Status
firefox87 --- wontfix
firefox88 --- fixed

People

(Reporter: ke5trel, Assigned: ckerschb)

References

(Blocks 1 open bug, )

Details

(Whiteboard: [domsecurity-active])

Attachments

(1 file)

STR:

  1. Enable HTTPS-Only mode.
  2. Visit http://pythontutor.com

Loading loops continuously due to the HTTPS page using a meta refresh to redirect to HTTP.

<meta http-equiv="REFRESH" content="0;url=http://pythontutor.com/index.html">

Not really sure why a page would do that but it's a legit bug, thanks for reporting. I guess we need find a way to break loops of upgrades/downgrades. We have a similar bug where JS redirects back to HTTP and HTTPS-Only tries to upgrade again.

Severity: -- → S4
Priority: -- → P3
Whiteboard: [domsecurity-backlog1]

A scripted "redirect" would lead to the same kind of loop and will need the same fix -- some way to detect and kill the loop, like the networking code detects an excessive number of 30x redirects. Then we could show the "try the HTTP version instead?" interstitial

Assignee: nobody → ckerschb
Status: NEW → ASSIGNED
Whiteboard: [domsecurity-backlog1] → [domsecurity-active]
Pushed by mozilla@christophkerschbaumer.com:
https://hg.mozilla.org/integration/autoland/rev/37aae4f2c6cf
Break endless upgrade downgrade loops when using https-only r=necko-reviewers,valentin,JulianWels
Backout by btara@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/37181c10ee52
Backed out changeset 37aae4f2c6cf for test_break_endless_upgrade_downgrade_loop.html failures CLOSED TREE

Backed out changeset 37aae4f2c6cf (bug 1691888) for test_break_endless_upgrade_downgrade_loop.html failures.

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&test_paths=dom%2Fsecurity%2Ftest%2Fhttps-only%2F&fromchange=37aae4f2c6cf87ed3d43dc59b8202316af47ac0d&selectedTaskRun=Yu_nlJ8IQHiyC2FFj2xg3A.0&tochange=cf95656a040db7c8a12a9393362d90726cebccfa

Backout link: https://hg.mozilla.org/integration/autoland/rev/37181c10ee52c4daee0117db0c7cc97a7089e0e4

Failure log: https://treeherder.mozilla.org/logviewer?job_id=332650683&repo=autoland&lineNumber=3653

[task 2021-03-10T08:24:12.113Z] 08:24:12     INFO -  SimpleTest START
[task 2021-03-10T08:24:12.114Z] 08:24:12     INFO -  TEST-START | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html
[task 2021-03-10T08:24:22.205Z] 08:24:22     INFO -  Buffered messages logged at 08:24:11
[task 2021-03-10T08:24:22.206Z] 08:24:22     INFO -  TEST-PASS | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html | A valid string reason is expected
[task 2021-03-10T08:24:22.206Z] 08:24:22     INFO -  TEST-PASS | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html | Reason cannot be empty
[task 2021-03-10T08:24:22.206Z] 08:24:22     INFO -  Buffered messages logged at 08:24:12
[task 2021-03-10T08:24:22.207Z] 08:24:22     INFO -  TEST-FAIL | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html | The author of the test has indicated that flaky timeouts are expected.  Reason: We need to wait for the HTTPS-Only error page to appear
[task 2021-03-10T08:24:22.207Z] 08:24:22     INFO -  Buffered messages finished
[task 2021-03-10T08:24:22.207Z] 08:24:22  WARNING -  TEST-UNEXPECTED-FAIL | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html | the error page should be shown for test1 - false == true - got false, expected true (operator ==)
[task 2021-03-10T08:24:22.207Z] 08:24:22     INFO -  ok@resource://specialpowers/SpecialPowersSandbox.jsm:87:21
[task 2021-03-10T08:24:22.207Z] 08:24:22     INFO -  verifyResult@http://mochi.test:8888/tests/dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html:40:5
[task 2021-03-10T08:24:22.208Z] 08:24:22     INFO -  execute@resource://specialpowers/SpecialPowersSandbox.jsm:141:12
[task 2021-03-10T08:24:22.208Z] 08:24:22     INFO -  _spawnTask@resource://specialpowers/SpecialPowersChild.jsm:1611:15
[task 2021-03-10T08:24:22.208Z] 08:24:22     INFO -  receiveMessage@resource://specialpowers/SpecialPowersChild.jsm:310:21
[task 2021-03-10T08:24:22.208Z] 08:24:22  WARNING -  TEST-UNEXPECTED-FAIL | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html | the error page should be shown for test2 - false == true - got false, expected true (operator ==)
[task 2021-03-10T08:24:22.208Z] 08:24:22     INFO -  ok@resource://specialpowers/SpecialPowersSandbox.jsm:87:21
[task 2021-03-10T08:24:22.208Z] 08:24:22     INFO -  verifyResult@http://mochi.test:8888/tests/dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html:40:5
[task 2021-03-10T08:24:22.208Z] 08:24:22     INFO -  execute@resource://specialpowers/SpecialPowersSandbox.jsm:141:12
[task 2021-03-10T08:24:22.209Z] 08:24:22     INFO -  _spawnTask@resource://specialpowers/SpecialPowersChild.jsm:1611:15
[task 2021-03-10T08:24:22.209Z] 08:24:22     INFO -  receiveMessage@resource://specialpowers/SpecialPowersChild.jsm:310:21
[task 2021-03-10T08:24:22.209Z] 08:24:22  WARNING -  TEST-UNEXPECTED-FAIL | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html | the error page should be shown for test3 - false == true - got false, expected true (operator ==)
[task 2021-03-10T08:24:22.209Z] 08:24:22     INFO -  ok@resource://specialpowers/SpecialPowersSandbox.jsm:87:21
[task 2021-03-10T08:24:22.209Z] 08:24:22     INFO -  verifyResult@http://mochi.test:8888/tests/dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html:40:5
[task 2021-03-10T08:24:22.209Z] 08:24:22     INFO -  execute@resource://specialpowers/SpecialPowersSandbox.jsm:141:12
[task 2021-03-10T08:24:22.209Z] 08:24:22     INFO -  _spawnTask@resource://specialpowers/SpecialPowersChild.jsm:1611:15
[task 2021-03-10T08:24:22.209Z] 08:24:22     INFO -  receiveMessage@resource://specialpowers/SpecialPowersChild.jsm:310:21
[task 2021-03-10T08:24:22.210Z] 08:24:22     INFO -  TEST-OK | dom/security/test/https-only/test_break_endless_upgrade_downgrade_loop.html | took 6774ms
Flags: needinfo?(ckerschb)

on it!

Flags: needinfo?(ckerschb)
See Also: → 1697866
Pushed by mozilla@christophkerschbaumer.com:
https://hg.mozilla.org/integration/autoland/rev/ab8040e6f05c
Break endless upgrade downgrade loops when using https-only r=necko-reviewers,valentin,JulianWels
Regressions: 1697975
See Also: → 1697976
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 88 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: