1696954 - HTTPS Only Mode breaks http://shakespeare.mit.edu/

Status: NEW

(Core :: DOM: Security, defect, P3)

Description

[Arthur Edelstein [:arthur]]

If you visit http://shakespeare.mit.edu/ with HTTPS-Only Mode enabled, it redirects to HTTPS and shows an HTTP Auth dialog. Pressing cancel leads to a "401 Unauthorized" page.

If you open the lock doorhanger and turn off HTTPS-Only Mode for the site, it still then fails the same way as described above. Not sure why!

Comment 1

[Christoph Kerschbaumer [:ckerschb}]

Hey Leli, do you wanna take a look and find out what's causing the problem here?

Comment 2

[Leli]

For some reason the httpsOnlyStatus flag for the doorhanger exemption is not set ... haven't figured out yet where this is (not) happening

Comment 3

[Leli]

Ok I have a basic understanding question about the doorhanger and what the expected behaviour should be:

• am I allowing this specific page to be exempt or
• am I allowing this specific tab to be exempt?

It seems to me to be a mix of both. If I have previously exempted the page I can switch in the exempt tab to this page. but if i delete the history of the page even if I'm in an exempt tab I will end up on the error page.

So for this shakespeare page I can't exempt the page itself since the doorhanger is not visible before I deal with the auth pop up and the exemption from the tab only works if I also exempt the page specifically.

Comment 5

[Juliana Gaibler [:juliana]]

When users change the permission in the site-identity panel, this function gets called: https://searchfox.org/mozilla-central/rev/1a47a74bd5ba89f2474aa27c40bd478e853f3276/browser/base/content/browser-siteIdentity.js#505,533-542

When this._isAboutHttpsOnlyErrorPage is true we set the exemption for HTTP, instead of HTTPS.

I hope we can somehow get the response-code, maybe this would be similar to this:
https://searchfox.org/mozilla-central/rev/1a47a74bd5ba89f2474aa27c40bd478e853f3276/toolkit/components/thumbnails/PageThumbUtils.jsm#369,385,390,393

Comment 6

[Juliana Gaibler [:juliana]]

Sorry, I messed that up :(

Comment 7

[Leli]

Attachment: Bug 1696954 - HTTPS Only Mode breaks http://shakespeare.mit.edu/

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:ckerschb, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 9

[Christoph Kerschbaumer [:ckerschb}]

This is blocking the right meta bug - backlog seems fine for now.