1694705 - the new "HTTPS-only" affect IP address when it has no response

Status: NEW

(Core :: Security, defect)

Description

[dindog]

If a pure ip address like "192.168.0.7" is failed opening(no response, be reset ...), the https-only config will replace the "http" in address bar to "https", which make no sense.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::Address Bar' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Juliana Gaibler [:juliana]]

HTTPS-Only Mode does not upgrade local IP addresses.

This is something else. When http://192.168.0.7 does not respond, the browser tries again with https://192.168.0.7. The flag for it isbrowser.fixup.fallback-to-https (see bug 1002724).

Comment 3

[dindog]

(In reply to Julian Gaibler from comment #2)

HTTPS-Only Mode does not upgrade local IP addresses.

This is something else. When http://192.168.0.7 does not respond, the browser tries again with https://192.168.0.7. The flag for it isbrowser.fixup.fallback-to-https (see bug 1002724).

I've been tweaking my Openwrt router for last few days, and for many times when I restart the router, it will not response from time to time, I don't see this is a "fix", especially without any notice to user.

If one is about to connect to a IP address in HTTPS, he probably know what is he doing, he will add the "s" himself. (it's not common using https for ip address)

Instead, if the user doesn't have the basic knowledge about HTTP/HTTPS, then he likely will not notice the address is changed by browser. In this case, refresh will not work even the server it's back to life, and user will have a conclusion like: Chrome will show the page after the router is ready and Firefox won't, Firefox must have a compatibility issue here... I thought that way before I notice the HTTPS in address bar, and I believe I have average knowledge about browser..

Comment 4

[Drew Willcoxon :adw]

It's not the front-end address bar that makes the decision to retry the load in https, so I'll move this to Core for further triage.