1913147 - Don't allow Firefox to automatically open the Windows Store app upon clicking a Windows Store URL

Status: RESOLVED INCOMPLETE

(Web Compatibility :: Site Reports, defect, P1)

Description

[particlecore]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0

Steps to reproduce:

This is related to a bug that was closed without any change to this issue (bug 1567206). I am now FORCED to use a different browser whenever I have a problem in my Windows Store App that prevents me from updating/installing apps because every single time Firefox opens the Windows Store App when I need to download the executable. If I do the exact same thing using Chrome then it downloads the executable just fine, only Firefox keeps doing this silly behavior for years.

Steps to reproduce below:

Open the following webpage
https://apps.microsoft.com/detail/9nksqgp7f2nh?hl=en-us&gl=US
Click on the Download button while in a Windows OS (I am using Windows 10)

Actual results:

The Windows App Store in the operating system opens

Expected results:

The respective executable should have been downloaded.
I did not click on the "View In Store" button that is next to the "Download" button, so the browser should NEVER open the store app if I did not click where it was expected to open the store app. If I click on the "Download" button I expect for the app to be downloaded and nothing else, just like how Chrome does it.

Comment 1

[particlecore]

Just to make my use case more clear: my windows store app occasionally has problems with downloading/updating apps. when that happens I have to open the respective apps on the web to download/update them manually by installing the executable myself. if I try to do this with Firefox, it always sends me back to the store app which has problems, when it should just download the executable as expected.

I looked for any settings in Firefox to change this default behavior, but you guys baked it in the browser which is very invasive and completely at odds with what anyone would expect from such a browser.

Doing the exact same thing with Chrome works just fine, it doesn't open the Store App automatically and instead downloads the executable file just fine.

Just do the same thing, that's the fix for this.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Win32' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Ray Kraesig [:rkraesig]]

Forwarding to Firefox :: File Handling, matching the cited bug 1567206.

(I'm afraid I can't reproduce this, however: if I click "Download" on the linked page, I get "WhatsApp Installer.exe".)

Comment 4

[particlecore]

Attachment: example recording

Comment 5

[particlecore]

Attachment: file handling settings screenshot

Comment 6

[particlecore]

I have attached a recording showing the problem behavior and a screenshot showing no option for me to change that behavior, nor defined anywhere I could find in a reasonable fashion.

Just to remind again, this is Firefox on Windows 10.

Comment 7

[:Gijs (he/him)]

I also can't reproduce, using Firefox on Windows 11. I don't have access to Windows 10. I expect at least some of the difference in what we're seeing may be down to decisions the Windows Store website is making (ie whether to offer a file or open the windows store). Firefox may not have control over this. We could potentially prevent opening the Windows Store, but that would not help in terms of doing the thing you want (ie downloading the executable).

If you create a clean profile for testing ( https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles ), does that reproduce the same issue?

If not, there is probably some settings difference that is tripping this behaviour - we'd need to narrow down what that is, so that we can reproduce and then work out how to address the issue.

One other question: in about:config, if you search for ms-windows-store, what settings show up, if any?

Comment 8

[particlecore]

There are two results for ms-windows-store with both values unchanged:

network.protocol-handler.external.ms-windows-store shows as true
network.protocol-handler.warn-external.ms-windows-store shows as false

Using a different profile is not an option, every time I tried that in the past it messed the profiles permanently and I don't want to risk it again.

Comment 9

[particlecore]

I also tried changing both values, and the only change is the windows store no longer opens, but also nothing downloads still.

Comment 10

[:Gijs (he/him)]

(In reply to particlecore from comment #9)

I also tried changing both values, and the only change is the windows store no longer opens, but also nothing downloads still.

What happens if you open the apps page in private browsing and try to use it there?

FWIW, I'm now no longer seeing a Download button on the site at all, only "Copy Link". I fully expect this is just Microsoft A/B testing different things and there's nothing Firefox can do about that...

Comment 11

[particlecore]

When I open in private mode then it works, the file downloads and the Windows Store app does not open automatically.

I have no idea what this means though, but at least is a workaround I can use until the original problem can be fixed.

Comment 12

[particlecore]

I installed Nightly and ran the same test, the file downloads as expected and the windows store does not open when clicking the download button anymore.

I did a diff checker of the source code between both browsers and there is no difference whatsoever. I was assuming that maybe some resources it was loading could be different, but there was no difference at all.

I also eliminated all history, local data, cookies, and every information I could find for that website in my original profile and then refreshed, but made no difference - which is very odd.

Unsure how to interpret this.

Comment 13

[:Gijs (he/him)]

I'm going to move this to website compatibility; at this point it's unclear that there's anything Firefox itself is doing differently that would explain what's happening here.

Comment 14

[particlecore]

In my opinion, users should be capable of configuring when a website has the privilege to directly open desktop apps directly. Currently, as was extensively documented in this bug, there is absolutely no way of a user doing that, at least none that can be found in a reasonable way, nor any suggested so far.

We already have rules for what to do with specific files, we should have the same control ability for situations like this. I don't expect for regular users to just be told to go to about:config and toggle a flag to stop it from happening, and it is definitely being allowed by the browser since the browser is the intermediary here between clicking the website button and opening the window store app.

Comment 15

[particlecore]

Also, I was never prompted at any time as to what I wanted to do when I clicked that button, not even once. Other actions typically prompt the user what he wants to do, and even offer the option of making his selection the default, but this one never did, it is automatically granted internally as far as I understand.

Comment 16

[:Gijs (he/him)]

(In reply to particlecore from comment #14)

we should have the same control ability for situations like this.

You do, for any other protocol. There'll be a Permissions toggle in the address bar where you can revoke permission for a site to open a particular protocol - if at any point you gave a site permission to open a particular protocol (e.g. for skype.com to open skype:, whatsapp to open whatsapp URLs, etc. etc.). The about:config pref I suggested you could change is one that we ship by default on Windows since bug 866065 (around the time we were going to try to ship a separate version of Firefox for Windows 8 "Metro"... if anyone remembers that...). It predates us introducing site-specific permissions for protocols, which was a hardening measure all browsers introduced around 4-5 years ago.

From bug 1567206,

(In reply to Daniel Veditz [:dveditz] from comment #1)

Apparently in bug 866065 we made an explicit choice to launch this specific app without asking for compatibility with Chrome and Edge, as well as to resolve a poor user experience. Normally I would say launching without asking is dangerous, but this is essentially part of the Windows OS and I'm fairly confident that if there's a security bug in it MS will patch it quickly and has extensive telemetry that would alert them to abuse.

Chrome no longer opens "view in store" button links without prompting, though Edge still does. The UX we offer in this case has improved since that bug was closed (with a clearer dialog if there is only 1 known handler for a protocol, instead of making users choose one). So I imagine we'll want to change the default. I'll file a new bug for that.

I still don't know why "Download" would ever open the Windows store; that is likely a decision by the MS website, and we can keep this bug for that.

Comment 17

[Daniel Veditz [:dveditz]]

When I spoof my userAgent to be Chrome on Windows the button changes to "Install" with a ms-window-store: link. That makes more sense than a "Download" label.

Comment 18

[Daniel Veditz [:dveditz]]

The UX we offer in this case has improved since that bug was closed (with a clearer dialog if there is only 1 known handler for a protocol, instead of making users choose one).

Does that mean bug 1677753 will be fixed when you change the pref defaults?

Comment 19

[:Gijs (he/him)]

(In reply to Daniel Veditz [:dveditz] from comment #18)

The UX we offer in this case has improved since that bug was closed (with a clearer dialog if there is only 1 known handler for a protocol, instead of making users choose one).

Does that mean bug 1677753 will be fixed when you change the pref defaults?

Yes, good catch!

Comment 20

[Dennis Schubert [:denschub]]

Redirecting ni to myself

Comment 21

[Daniel Holbert [:dholbert]]

Attachment: screenshot showing dholbert getting a prompt for each of the buttons here

Is this still reproducible for anyone? I just tested on Windows 11 and Windows 10, and I can't reproduce in either.

In Windows 10 (matching the user's environment), I'm using a brand-new installation of Windows 10 with a brand new Firefox 132.0.2 installation.

• If I tap the "Download" button (per STR), it downloads an .exe file. (If I launch that .exe, I get a self-contained installer that downloads and launches a standalone WhatsApp app.) The store does not open at any point.
• and just for completeness -- if I do explicitly tap the Windows-store-icon button, it spawns a prompt from Firefox asking me if I want to allow the Windows store app to handle these links. The app only launches if I click "Open Link" in that prompt. If I leave "Always allow" unchecked, then I get the same prompt again the next time I tap the Windows-store button.

So: I think everything is working-as-expected now, unless I'm misunderstanding something?

Comment 22

[Daniel Holbert [:dholbert]]

So, this part explains why (from a security perspective) the store app was able to launch automagically from a link clicked in a page, at least:

(In reply to particlecore from comment #8)

There are two results for ms-windows-store with both values unchanged:

network.protocol-handler.external.ms-windows-store shows as true
network.protocol-handler.warn-external.ms-windows-store shows as false

Those preferences are not present for me, in a fresh Firefox profile's about:config. However, if I manually create those prefs with the values you noted, then clicking the microsoft-store icon does automatically open the store with no prompt/warning from Firefox. (It's not entirely clear why this would happen from the Download button, but that may just have been Microsoft testing different versions of the site, or perhaps the same piece of external software causing behavior to change.)

To reiterate -- neither of those about:config preferences are present (with any value) by default in Firefox. I don't know why they would have been set for you, except maybe by some sort other software or customization. (Are you using a custom deployment of Firefox for an enterprise? Or maybe you've got some Firefox extension that set them for you? Or maybe you've got some sort of antivirus software that twiddles various things in Firefox for its own reasons?) (EDIT: sorry, my mistake -- it turns out these prefs used to be set by default but they were recently removed, per my next comment.)

When I open in private mode then it works, the file downloads and the Windows Store app does not open automatically.

This^ fact (that you're getting a different experience in private browsing mode) probably means that either...
(1) you've got a Firefox extension that's messing with things here (extensions are off-by-default in private browsing windows, so it's not able to change behavior there)

(2) Microsoft is doing an A/B test on you and they've set some sort of cookie (or similar local marker) which is opting you into this particular experience (and that cookie isn't available in private browsing mode). (Comment 12 suggests that maybe you ruled this out already.)

If you're still experiencing this bug, could you try disabling all of your extensions (using on/off sliders at about:addons, after tapping "Extensions" button on the left)? If that does fix this, you could try bisecting them (enabling half, retesting, etc) to find the problematic extension. Or if that doesn't fix this: then you might try deleting cookies/etc. by visiting https://apps.microsoft.com and clicking the lock icon and clicking "Clear cookies and site data".

Does any of that help? (if you're even still seeing this behavior)

Comment 23

[Daniel Holbert [:dholbert]]

Aha, actually -- it looks like the situation with those two prefs changed recently; those prefs used to be present with the values you described, but they were removed as of Firefox 132, in bug 1916193. So: that explains why you were seeing them there but I'm not seeing them at all now.

That reduces the likelihood that there's external software involved here slightly. Still, it'd be good to see if either of the suggestions at the end of previous comment ("If you're still experiencing this bug, ...") help out here.

Comment 24

[Daniel Holbert [:dholbert]]

Also, for completeness -- I just retested this using a fresh install of Firefox 129 on Windows 10, and I'm getting expected-results there (for the before bug 1916193 experience) -- "Download" gets me an .exe, and the windows store app automatically launches the windows store.

So: if you're still seeing this, you're getting a different version of the site, for unknown reasons.

Comment 25

[Daniel Holbert [:dholbert]]

Closing as "incomplete" for now; per recent comments, we're not sure how to reproduce this, and even the original reporter couldn't reproduce in private-browsing-mode which suggests there's some unknown state required. So, this doesn't seem to actually be a broad webcompat issue. And we've improved the UX of at least one of the flows here in bug 1916193.