1788011 - [Security] Smart HTTP to HTTPS redirect not enabled in Firefox 104.0 (64-bit)

Status: RESOLVED DUPLICATE of bug 1704453

(Core :: DOM: Security, defect)

Description

[Mart Gil Robles]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36

Steps to reproduce:

Description:
Firefox didn't smartly redirect users from HTTP to HTTPS -- which Google chrome did. I understand that some browser vendor can/would be able to customize the browser's behaviour according to their needs though, modern browsers can protect their users against MITM by supporting the suggested change.

1. Open Firefox Browser v104.0 (64 bit)
2. Visit http://keyserver.pgp.com/
3. Noticed that the website is loaded in HTTP and not in HTTPS

If we actually tested this in the latest version of Google Chrome, that will give us a secure web application by smartly redirect to HTTPS;

Curl resembles the same output though we can say that users will less likely interact webapps through curl so it would be helpful we can have at least the same behavior from Google Chrome into Firefox.

curl 'keyserver.pgp.com' --head -XGET -L
HTTP/1.1 302 Found
Date: Tue, 30 Aug 2022 09:14:05 GMT
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-store, no-cache, max-age=0
Location: http://keyserver.pgp.com:80/vkd/GetWelcomeScreen.event
Content-Length: 238
Content-Type: text/html; charset=iso-8859-1

HTTP/1.1 200 200
Date: Tue, 30 Aug 2022 09:14:05 GMT
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Cache-Control: no-store, no-cache, max-age=0
Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline' 'self'; object-src blob:; style-src 'unsafe-inline' 'self';
X-Permitted-Cross-Domain-Policies: none
Set-Cookie: JSESSIONID=39F9F0129C02FCA98D500BC3DA9CE7DE; Path=/vkd; HttpOnly
Content-Type: text/html;charset=UTF-8
Content-Length: 12857

Actual results:

HTTP website retains from being in HTTP, whereas Google Chrome smartly redirect HTTP to HTTPS content.

Things to consider when redirecting HTTP to HTTP -> make sure no webpage that is served on HTTPS of that particular website. Have a look at the example below:

curl 'https://keyserver.pgp.com' --head -XGET
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Expected results:

Firefox should smartly redirect HTTP content to HTTPS similar to what Google chrome did. Would be helpful to lessen incident like Man in the middle attack.

Comment 1

[:Gijs (he/him)]

(In reply to Mart Gil Robles from comment #0)

Firefox didn't smartly redirect users from HTTP to HTTPS -- which Google chrome did.

I don't see a redirect in Chrome, on a clean Chrome profile on macOS with latest Chrome. I expect you have an add-on installed or experimental feature enabled that does this in Chrome, or that you visited some part of this site before in Chrome which had an Upgrade-Insecure-Requests header or the CSP equivalent.

In Firefox, you can enable "https only" in the Firefox Settings, which would do what you want (and show an error page for pages not reachable using https).

You can also enable "https first" (which is a bit less aggressive) using the internal dom.security.https_first pref in about:config. This is default-enabled in private browsing as of August last year (Firefox 91).

There are also third-party add-ons like "https everywhere".

I'm clearing the security flag as there is no real point keeping this bug hidden.

Whatever browsers do, keyserver.pgp.com owners may wish to add Upgrade-Insecure-Requests headers and/or redirects to the https version of their site themselves...

Comment 2

[Daniel Veditz [:dveditz]]

Already on the roadmap, but still a bunch of edgecases to fix