1877935 - Make sure we pass tests in WPT for https-upgrades

Status: NEW

(Core :: DOM: Security, task, P4)

Description

[Frederik Braun [:freddy]]

If we want to ship https-first, we ought to align on the HTTPS Upgrades proposal in whatwg. In turn, this means that we should support the tests (and make sure that wpt annotations for the https-upgrades/ folder point to DOM: Security and https-first-mode.

link to wpt dashboard for https-ugprades folder: https://wpt.fyi/results/https-upgrades/tentative?label=master&label=experimental&aligned

Comment 1

[Malte Jürgens [:maltejur] (ooo until 2025-02-21)]

I also took a look at this recently. Even annotating all the testing/web-platform/meta/https-upgrades/tentative/*.html.ini files with prefs: [dom.security.https_first:true] does not seem to make the tests pass. So it seems to me that HTTPS-First does not yet work with those tests. I think that is because these tests use custom ports to test the upgrades. Quote from one of the tests:

HTTPS upgrades don't change custom ports, so this will load correctly if an HTTPS upgrade is performed, and will fail to load otherwise (since the port will be wrong for http).

I am pretty sure the WIP spec also supports this way of testing HTTPS upgrades. So the next step is probably to adjust our HTTPS-First behavior when it comes to custom ports. But when we notice that our behavior makes more sense, I could also imagine asking in the PR to adjust the spec and WPTs.

Simon, do you want to take a look at this, or should I work on it?

Comment 2

[Simon Friedberger (:simonf)]

Redirect chain information was reduced in https://bugzilla.mozilla.org/show_bug.cgi?id=1715785 because the redirect chains are passed to the content process.
This will cause a false-positive when the redirect only changes the query parameters.
This will fail https://wpt.fyi/results/https-upgrades/tentative/http-redirecting-to-http-redirecting-to-http.https.sub.html?label=master&label=experimental&aligned. It redirects multiple times to http://{{host}}:{{ports[https][0]}}/fetch/api/resources/redirect.py?location=.

Comment 3

[Simon Friedberger (:simonf)]

Attachment: WIP: Bug 1877935 Fix HTTPS upgrade WPT tests r=freddyb

Comment 5

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 6

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 7

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 8

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 9

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 10

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 11

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 12

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Remove unneeded check r=freddyb

Comment 13

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 Improve redirect test r=freddyb

Adds an additional test which redirects to a different host using HTTP.
Such a request should be upgraded by HTTPS-first.

Depends on D204369

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/07723c9032f2
Remove unneeded check r=freddyb
https://hg.mozilla.org/integration/autoland/rev/cce7d3d3687f
Improve redirect test r=freddyb

Comment 15

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/07723c9032f2
https://hg.mozilla.org/mozilla-central/rev/cce7d3d3687f

Comment 16

[BugBot [:suhaib / :marco/ :calixte]]

The leave-open keyword is there and there is no activity for 6 months.
:simonf, maybe it's time to close this bug?
For more information, please visit BugBot documentation.

Comment 17

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 - Enable HTTPS-First for non-default ports r=maltejur

Comment 18

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935 - Make tests pass r=maltejur

Depends on D225241

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ca419c505418
Enable HTTPS-First for non-default ports r=maltejur,necko-reviewers,devtools-reviewers

Comment 20

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/ca419c505418

Comment 21

[Simon Friedberger (:simonf)]

Attachment: Bug 1877935: Add prefs to pass https-upgrades WPT tests. r?freddyb!

Comment 22

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7a267748097e
Add prefs to pass https-upgrades WPT tests. r=freddyb

Comment 23

[amarc]

https://hg.mozilla.org/mozilla-central/rev/7a267748097e

Comment 24

[Simon Friedberger (:simonf)]

When trying to enable this globally some BFCache tests are failing this might be due to Bug 1897075.

Comment 25

[Frederik Braun [:freddy]]

Just to give a status update. Tests on wpt do not use default ports and the feature is entirely built in a way that only upgrades when a connection is using a default port, which makes it a bit... hard to test.

We could set a pref to upgrade non-default ports in tests only, but no other browser seems to do that and the tests are apparently in a bit of a dire situation.

Thinking about this, I think the best case scenario would be for us to share a set of test cases that Firefox passes and set the pref such that other browsers can see what we do. Seems like others are not really interested in maintaining or passing these tests anyway.

I'm downranking the priority as there is nothing we would gain from this at the moment (but potentially longer term). It's not required for our release.