2008317 - [unified trust panel] http-only "Not Secure" shield loses its red slash (making it look more-trustworthy) when you turn off tracking protection

Status: VERIFIED FIXED

(Firefox :: Address Bar, defect)

Description

[Daniel Holbert [:dholbert]]

STR:

1. Visit http://http.badssl.com/ (note, this is an insecure http-only website)
2. Look at the shield at the left side of the URL bar (notice the red slash).
3. Click the shield and click the slider to turn off tracking protection.
4. Look at the shield at the left side of the URL bar again.

ACTUAL RESULTS:
The shield does not have a red slash after step 4. (i.e. it loses the red slash if you've turned off tracking protection.)
It does gain a small "x", but that's less prominent and has less of a color-enhanced "warning" feel.

EXPECTED RESULTS:
We should probably preserve some redness (maybe the same red slash) to indicate that this is an insecure HTTP connection.

I'm using Nightly 148.0a1 (2025-12-29)

Comment 1

[Daniel Holbert [:dholbert]]

INFO: Last good revision: 7c6e6dc03dc0fd5049e5cba70fcf669cb2e772d7 (2025-12-09)
INFO: First bad revision: 193270a369a8a26ae3dc8689656cc09748f37811 (2025-12-10)
INFO: Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7c6e6dc03dc0fd5049e5cba70fcf669cb2e772d7&tochange=193270a369a8a26ae3dc8689656cc09748f37811

Looks like this is part of the new "trustpanel" UI, enabled in bug 1988726. Before we enabled that, we showed a lock icon next to the shield, and the lock icon is what got the red slash through it (and retained the red slash regardless of ETP enablement).

--> Marking as regression from bug 1988726, though it's Nightly-only right now, I think:

https://searchfox.org/firefox-main/rev/aee7c0f24f488cd7f5a835803b48dd0c0cb2fd5f/browser/app/profile/firefox.js#427-431

#ifdef NIGHTLY_BUILD
pref("browser.urlbar.trustPanel.featureGate", true);
#else
pref("browser.urlbar.trustPanel.featureGate", false);
#endif

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1988726

:daleharvey, since you are the author of the regressor, bug 1988726, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Daniel Holbert [:dholbert]]

Attachment: screenshot (top: insecure http URL. bottom: insecure http url with ETP turned off)

Comment 4

[Dale Harvey (:daleharvey)]

Feature not currently enable on release so not affecting release.

This was implemented as per the design spec, the ETP display was prioritised over the not secure, possibly chosen because the text "Not Secure" is already quite prominent right there. I will forward on to the UX team to consider though, it may be possible to make the X red.

Comment 5

[Dale Harvey (:daleharvey)]

Also as this isnt a bug, a potential design change gonna take off it blocking release

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1988726

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jteow, could you have a look please?

For more information, please visit BugBot documentation.

Comment 8

[James Teow [:jteow]]

I set this to P2 since it was enabled for 149, so we may want to ensure we get UX's take on this sooner rather than later.

Comment 9

[James Teow [:jteow]]

Hmm because of the tracking flags, it remains a defect so I'll keep it as that. I've set the severity to S4 since it's a visual change and left the priority open until we get UX feedback.

Comment 10

[Lesley Norton [:lnorton]]

:jteow did we hear back from UX regarding priority for this?

Comment 11

[Dale Harvey (:daleharvey)]

Discussing with UX and they have recommended prioritising the not secure icon when a site is not secure and etp protections turned off.

Comment 12

[Dale Harvey (:daleharvey)]

Attachment: Bug 2008317 - Prioritise insecure icon over etp disabled. r=daisuke

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/eaa1b65e8642
https://hg.mozilla.org/integration/autoland/rev/7a29a535a217
Prioritise insecure icon over etp disabled. r=daisuke,desktop-theme-reviewers,urlbar-reviewers,Itiel

Comment 14

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/7a29a535a217

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:daleharvey, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox149 to wontfix.

For more information, please visit BugBot documentation.

Comment 16

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: This code fixes a regression in a security related area of the UI
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Open httpforever.com with etp disabled, should see insecure icon
• Risk associated with taking this patch: low
• Explanation of risk level: Small patch with tests
• String changes made/needed: N/A
• Is Android affected?: no

Comment 17

[Dale Harvey (:daleharvey)]

Attachment: Bug 2008317 - Prioritise insecure icon over etp disabled.

Original Revision: https://phabricator.services.mozilla.com/D285426

Comment 18

[Dale Harvey (:daleharvey)]

Yup made an uplift request for this

Comment 19

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/6224250b036b
https://hg.mozilla.org/releases/mozilla-beta/rev/bc4c1682bae4

Comment 20

[Negritas Sergiu, Desktop QA]

Hello! I can confirm that the issue is fixed with firefox 150.0a1(2026-03-05) on Ubuntu 22.04, macOS 15.6.7 and Windows 10.

I will update the flags and status for this issue.

Have a nice day!