1799541 - upgradeToSecure results in https redirect loop

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Rob Wu [:robwu]]

Currently, when upgradeToSecure is returned for a https URL, a redirect loop occurs (and eventually broken when the limit on the number of internal redirects is reached, ~20).

That happens because the flag propagates from here to here, after which an unconditional redirect to the https version of the URL occurs.

What should be happening instead is for the upgrade to be ignored if the request already uses a secure scheme. This used to be the case when introduced in bug 1149250, but was regressed by https://searchfox.org/mozilla-central/diff/50316df2bbad5bd67e490d3e302943ddb5be183e/netwerk/protocol/http/nsHttpChannel.cpp#546 (note the move from the mUpgradeToSecure lookup outside of the isHttp branch).

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1521729

Comment 2

[Rob Wu [:robwu]]

Attachment: Bug 1799541 - Avoid redirect loop when channel.upgradeToSecure is used

Comment 3

[Pascal Chevrel:pascalc (PTO until April 26)]

We are in RC week, wontfix 106.

Comment 4

[Donal Meehan [:dmeehan]]

Could you set a severity on this?
Is this something we need on the radar for a potential 107 ride-along or ride the trains in 108?

Comment 5

[Rob Wu [:robwu]]

S4 - extension developers can work around this by checking whether the request URL is "https", and if so skip the result.
This regression went unnoticed for a long while so we can just ride the trains.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aceb2c66669b
Avoid redirect loop when channel.upgradeToSecure is used r=necko-reviewers,valentin

Comment 7

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/aceb2c66669b