2010438 - Upgrade insecure requests wrongly upgrades unsupported ports coming from iframes

Status: ASSIGNED

(Core :: DOM: Security, defect)

Description

[Jonathan Kingston [:jkt] he/him]

testing/web-platform/meta/upgrade-insecure-requests/link-upgrade.sub.https.html.ini lists the following fails:

• [./link-upgrade/iframe-top-navigation-upgrade-1.sub.html]
• [./link-upgrade/iframe-top-navigation-upgrade-2.sub.html]
• [./link-upgrade/iframe-top-navigation-upgrade-meta.sub.html]

Gecko is incorrectly applying upgrade-insecure-requests (UIR) to top-level HTTP navigations initiated from iframes, regardless of whether the upgrade would actually work.

The problem: UIR changes http://host:port → https://host:port (same port number). This breaks when the server doesn't have HTTPS on that port.

Comment 1

[Jonathan Kingston [:jkt] he/him]

Attachment: Bug 2010438 - Prevent upgrade insecure requests from upgrading unsupported ports from iframes. r?smaug