Closed
Bug 1719770
Opened 4 years ago
Closed 3 years ago
Redirect to http:// with HSTS is not upgraded by HTTPS-Only
Categories
(Core :: DOM: Security, defect, P2)
Tracking
()
RESOLVED
DUPLICATE
of bug 1722489
| Tracking | Status | |
|---|---|---|
| firefox91 | --- | affected |
People
(Reporter: mt, Assigned: t.yavor)
References
(Blocks 1 open bug)
Details
(Whiteboard: [domsecurity-backlog1])
Attachments
(1 file)
I have HTTPS-Only mode enabled. For some reason, there is a bug on a server that causes a request to https://XXX/long.url... to be return an HTTP 302 to http://XXX/login.page....
This is the first request I have made to that origin, so maybe the strict-transport-security that is included in the response hasn't taken hold yet. What is most curious is that the subsequent request is upgraded by neither HSTS nor HTTPS-Only. I get the warning interstitial instead.
This is reproducible, but I won't share the URL publicly because I don't want to 0-day the server. I can share details privately.
|
Reporter | |
Updated•4 years ago
|
Blocks: https-only-mode
|
||
Updated•4 years ago
|
Severity: -- → S2
Priority: -- → P2
Whiteboard: [domsecurity-backlog1]
|
|
||
Comment 1•4 years ago
|
||
Tomer, can you please investigate? I'll share a link with you privately.
Flags: needinfo?(lyavor)
|
Assignee | |
Updated•4 years ago
|
Assignee: nobody → lyavor
Flags: needinfo?(lyavor)
|
|
Assignee | |
Comment 2•4 years ago
|
||
|
|
Assignee | |
Updated•3 years ago
|
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•