1897136 - Fix HTTPS->HTTP downgrades when using proxies

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Simon Friedberger [:simonf]]

For HTTPS first we want to treat NS_ERROR_UNKNOWN_HOST as an HTTPS
related error because it might be a 404 returned by a proxy (see
HttpProxyResponseToErrorCode). For the HTTPS-only case we don't want
that because it almost always is an unrelated error and the users would
have to confirm the interstitial every time to find out.

Comment 1

[Simon Friedberger [:simonf]]

A first fix was attempted in https://bugzilla.mozilla.org/show_bug.cgi?id=1894662

Comment 2

[Simon Friedberger [:simonf]]

The practical relevance of weird proxy setups is low. The error mode here is that we fail to downgrade to an insecure connection in which case a user can manually switch to an explicit http:// scheme. The actual security impact seems to be minimal since the CONNECT case is not affected and in other cases no secure connection to the destination is achieved anyway. Valentin, do you agree?

I suggest we WONTFIX.

Comment 3

[Simon Friedberger [:simonf]]

Okay, this is not a security issue but it might be a usability issue. Skipping downgrades might lead to people seeing connection failures where an HTTP connection would have worked.

Comment 4

[Simon Friedberger [:simonf]]

Attachment: Bug 1897136 - Fix HTTPS first downgrades for proxies r=maltejur,valentin

For HTTPS first we want to treat NS_ERROR_UNKNOWN_HOST as an HTTPS
related error because it might be a 404 returned by a proxy (see
HttpProxyResponseToErrorCode). For the HTTPS-only case we don't want
that because it almost always is an unrelated error and the users would
have to confirm the interstitial every time to find out.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a6b70bf9b1b3
Fix HTTPS first downgrades for proxies r=maltejur,valentin,extension-reviewers,robwu

Comment 6

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/a6b70bf9b1b3