Wrong cache behavior.
Categories
(Core :: Networking: Cache, defect)
Tracking
()
People
(Reporter: kozeluh, Unassigned)
Details
Attachments
(4 files)
screenshot
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Steps to reproduce:
Configure old router on http://192.168.0.1:8080, replacing router with a new one with same IP but http on 80 (e.g. http://192.168.0.1 or http://192.168.0.1:80). Browser won't open login dialog instead it redirects to a dead page on port 8080. Chromium opens web page correctly. Probably it's because of old cached page which redirect to port 8080 but it should't overwrite the address again after manual repair of address. Probably it could be used for browser hijack.
Actual results:
Unable to open new login page.
Expected results:
Do not overwrite manually added port number on address bar! Never!
|
||
Comment 1•2 years ago
|
||
The Bugbug bot thinks this bug should belong to the 'Firefox::Address Bar' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Comment 2•2 years ago
•
|
||
Is the urlbar autofilling the port like in the screenshot I'm posting (I typed the non selected part), or when you press enter there is the exact right url in the urlbar, but it then redirects to the wrong one?
Old router worked on 8080 but there was redirect from 80 (I'll open 192.168.0.1 and it's immediately redirects to 192.168.0.1:8080). I think it cached simple page on port 80 and redirects to port 8080 even after router went offline. Unfortunately I'm not able use ctrl+f5 to refresh because of redirect.
But if I manually delete 80 or whole 8080 (address bar shows 192.168.0.1:80 or 192.168.0.1) it should recheck the page it's same like the one on cache.
I can imagine it could be used for malicious attack. Attacker will change for a short while home page with redirect code and returns it back. Nobody noticed home page change but few users will be redirected to malicious one.
|
|
||
Comment 4•2 years ago
|
||
if you search for the domain (192.168.0.1) in the history sidebar (CTRL+H), right click on an Entry and pick Forget About This Site, is the problem resolved?
Now working after forgetting history of 192.168.0.1:8080 it's redirecting to wrong page.
|
|
||
Comment 6•2 years ago
•
|
||
Ok, sorry I must go by trial and error.
Could you please try going to about:preferences#privacy, click on the Manage Data button in the Cookies and Website Data section, check if 192.168.0.1 is in the list, select it and click on Remove Selected
is there any other entry in history sidebar pointing to that domain (ip actually)? Did you remove all of them?
Nothing in history, nothing in the Manage Cookies and Site Data, still redirecting. Unfortunately I can't create new profile and try it on clean one. I don't have the router to reproduce it again. Now I have only testing Mikrotik, where I can put IP and try if it works or not.
And sorry for "Now" on my previous post, it should be "Not".
|
|
||
Comment 8•2 years ago
|
||
OK, this is something either in network or cache, not sure, I don't think it's a urlbar bug anymore based on the above.
|
||
Comment 9•2 years ago
|
||
Hi, can you check in about:cache if you have any entries for http://192.168.0.1 ? If there is one, can you post its contents here?
There might indeed be a cached redirect.
It could be that the cache entry is still valid.
Or it could be a bug that we end up using it. Or there could be something else.
If there are no entries in about:cache, could you capture some http logging for us? Thanks!
|
Reporter | |
Comment 10•2 years ago
|
||
Hi, there are cached pages from old router and there is also page http://192.168.0.1:8080 where it took the redirect.
|
|
Reporter | |
Comment 11•2 years ago
|
||
Here is screen show about:cache with cached redirect page.
|
|
||
Comment 12•2 years ago
•
|
||
Is there any entry for http://192.168.0.1 (no port) ?
PS. If there is please click on it and post the contents here (I mostly care about the headers)
|
|
Reporter | |
Comment 13•2 years ago
|
||
Yes it is.
|
|
Reporter | |
Comment 14•2 years ago
|
||
Sorry, I've read the PS after posting previous picture.
|
|
||
Comment 15•2 years ago
|
||
The problem here is that the previous router sent back a redirect with no expiration or cache-control headers. That means the response is cached and valid.
I've confirmed that this scenario works the same in other browsers.
You can fix it by clearing the HTTP cache. Press Ctrl-Shift-Delete, Time range: Everything, only check Cache.
Thanks!
Description
•