1886184 - Provide a way to set Exceptions only for HTTPS-First and not HTTPS-Only

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P3)

Description

[Malte Jürgens [:maltejur]]

The current mechanism for setting exceptions for HTTPS-Only/First doesn't differentiate between the two. This becomes a problem in these two cases:

1. We want to automatically add a temporary HTTPS-First exception when a HTTPS-First upgrade fails (Bug 1884921), but that exception should not apply to HTTPS-Only.
2. We want to add default exceptions for sites that are broken with HTTPS-First (Bug 1816449), but we obviously still want a HTTPS-Only warning on these pages.

For the first point, we could implement clearing temporary exceptions when the user switches between HTTPS-First and HTTPS-Only, but that won't work when the user has HTTPS-First enabled in normal browsing and HTTPS-Only in PBM, and is using both simultaneously.

Comment 1

[Malte Jürgens [:maltejur]]

Attachment: Bug 1886184 - Add HTTPS-Only Permission Types exclusively for HTTPS-First r?freddyb!,simonf!,#permissions-reviewers!

Comment 2

[Malte Jürgens [:maltejur]]

Attachment: WIP: Bug 1886184 - Update Permission Manager UI to display HTTPS-First exceptions

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c4d16def2caf
Add HTTPS-Only Permission Types exclusively for HTTPS-First r=freddyb,simonf

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/c4d16def2caf