1728981 - WebSocket request is still being upgraded with permanent HTTPS only exception

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[Tom S. (please needinfo tschuster)]

I am running Home Assistant at homeassistant.local:8123. I haven't setup https for this, so I am disabling HTTPS-only mode for this. However WebSocket requests initiated by the zigbee2mqq dasboard are still being upgraded.

Putting a breakpoint in the nsHTTPSOnlyUtils::ShouldUpgradeWebSocket function, httpsOnlyStatus seems to be 17. I think that means HTTPS_ONLY_TOP_LEVEL_LOAD_IN_PROGRESS | HTTPS_ONLY_UNINITIALIZED ?

Comment 1

[Tom S. (please needinfo tschuster)]

The WebSocket connection seems to be made from an iframe, opening the frame in its own tab makes it work correctly.

Comment 2

[Daniel Veditz [:dveditz]]

same-origin frame, I assume?

Comment 3

[Tom S. (please needinfo tschuster)]

(In reply to Daniel Veditz [:dveditz] from comment #2)

same-origin frame, I assume?

Yes.

Comment 4

[Daniel Veditz [:dveditz]]

Hopefully we can get to this soon, but for now we probably don't have the people to make it "active" for a few weeks.

Comment 5

[Christoph Kerschbaumer [:ckerschb}]

I think what we need to do is add TestIfPrincipalIsExempt within nsHTTPSOnlyUtils::ShouldUpgradeWebSocket in case someone is going to pick that up.

Comment 6

[Tom S. (please needinfo tschuster)]

Adding TestIfPrincipalIsExempt to nsHTTPSOnlyUtils::ShouldUpgradeWebSocket works a treat. Interestingly enough the function is now almost identical to nsHTTPSOnlyUtils::ShouldUpgradeRequest, the only thing that is different the last few lines.

  // If the status was not determined before, we now indicate that the request
  // will get upgraded, but no event-listener has been registered yet.
  if (httpsOnlyStatus & nsILoadInfo::HTTPS_ONLY_UNINITIALIZED) {
    httpsOnlyStatus ^= nsILoadInfo::HTTPS_ONLY_UNINITIALIZED;
    httpsOnlyStatus |= nsILoadInfo::HTTPS_ONLY_UPGRADED_LISTENER_NOT_REGISTERED;
    aLoadInfo->SetHttpsOnlyStatus(httpsOnlyStatus);
  }

Comment 7

[Daniel Holbert [:dholbert]]

Note: in likely-older-dupe bug 1701386, it sounded like we weren't sure how to recreate the setup for this issue in a test.

If that's still the case (i.e. if we don't know how this can happen), I'm happy to do what I can to help, as someone who can reproduce this locally. In particular / for example, I have a pernosco trace of myself hitting the bug that I can share if that's useful.

I debugged it backwards a little bit, and I found that the same-origin iframe does not have HTTPS_ONLY_EXEMPT set in its mHttpsOnlyStatus member-var, even though the outermost iframe does have that flag set. There must be something special about the way the site is loading the iframe, which triggers this, because I can't reproduce that behavior from a trivial testcase that I wrote locally (an http-only page with a same-origin iframe).

Comment 8

[Tom S. (please needinfo tschuster)]

Attachment: Bug 1728981 - Don't upgrade HTTP WebSocket requests of exempt principals. r?ckerschb

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/70d050093e8f
Don't upgrade HTTP WebSocket requests of exempt principals. r=ckerschb

Comment 10

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/70d050093e8f