1759114 - expired.badssl.com will result in a https-only error

Status: RESOLVED WONTFIX

(Core :: DOM: Security, defect)

Description

[Petru-Mugurel Lingurar [:petru]]

Attachment: image.png

Issue reproduceable in Fenix, Focus and on Desktop.

STRs:

• enable https-only mode
• type in the url bar: expired.badssl.com (seems like any subdomains would work in reproducing the issue)

Expected result:

• Engine's RequestInterceptor's onErrorRequest fires with ERROR_SECURITY_BAD_CERT
• the error page for "secure connection failed" is shown

Actual result:

• Engine's RequestInterceptor's onErrorRequest fires with
  • errorType: ERROR_HTTPS_ONLY
  • uri: https://expired.badssl.com/
• the error page for https-only mode is shown

 
** If the full url - https://expired.badssl.com is accessed the expected scenario happens.

Comment 1

[Daniel Veditz [:dveditz]]

You can argue that some TLS errors are more okay-ish than others, but the HTTP-only implementation doesn't want to be entangled with those details and value judgements. If the user has requested "http" we are not going to upgrade them to a broken site. If you want to deal with the broken site then explicitly request "https"