1720458 - "Exceptions - HTTPS-Only Mode" are ignored when setting "Always use private browsing mode".

Status: VERIFIED FIXED

(Core :: Permission Manager, defect, P3)

Description

[Eiichi]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0

Steps to reproduce:

1. Go to the Preferences -> Privacy & Security -> HTTPS-Only Mode.
2. Select Enable HTTPS-Only Mode in all windows.
3. Click on Manage Exceptions...
4. Add "http://forums.mozillazine.org/" to "Turn Off" and save changes.
5. Go to the Preferences -> Privacy & Security -> History.
6. Select "Always use private browsing mode".
7. Quit and relaunch Firefox.
8. Open "http://forums.mozillazine.org/".

Actual results:

HTTPS-Only Mode Alert: "Secure Connection Not Available" window shows.

Expected results:

"http://forums.mozillazine.org/" page shows.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Security' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Daniel Veditz [:dveditz]]

I believe this was the intent of bug 1680237 -- bouncing over there for further triage.

Comment 3

[Johann Hofmann [:johannh]]

Whoever wants to tackle this can mirror what we did for cookie permissions, see https://searchfox.org/mozilla-central/source/extensions/permissions/PermissionManager.cpp#144

Note that this would also mean pre-loading the permission which is something we probably want to get rid of long term.

Comment 4

[Malte Jürgens [:maltejur]]

Attachment: Bug 1720458: Do not isolate `https-only-load-insecure` by origin attributes r?ckerschb

Do not isolate https-only-load-insecure by origin attributes. This way the HTTPS-Only exceptions will behave similar to the cookie permission. This means that exceptions set in the system settings will also apply to private windows, but exceptions set in private windows via the identity pane will be reset after closing the browser.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f4acc3a4ac2a
Do not isolate `https-only-load-insecure` by origin attributes r=fluent-reviewers,settings-reviewers,flod,ckerschb,Gijs

Comment 6

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/f4acc3a4ac2a

Comment 7

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

Unfortunately I wasn’t able to reproduce this issue. I used the STR provided but every time I tried to reproduce I got the expected result on an affected build. Would you be so kind as to verify this fix on latest beta build? Thank you.

Comment 8

[Eiichi]

(In reply to Ardelean Oana, Desktop QA from comment #7)

Unfortunately I wasn’t able to reproduce this issue. I used the STR provided but every time I tried to reproduce I got the expected result on an affected build. Would you be so kind as to verify this fix on latest beta build? Thank you.

I can confirm that this bug has been resolved on the latest beta version 117.0b9.

Comment 9

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

Marked as verified based on Comment 8. Updating accordingly.