2012113 - A website is not excluded if “www” is missed/added from/to its address in about:preferences

Status: VERIFIED FIXED

(Firefox :: IP Protection, defect)

Description

[Valentina Virlics [:vvalentina], VPN QA]

Attachment: bandicam 2026-01-23 13-35-59-784.mp4

[Affected versions]:

• Firefox Nightly 149.0a1 (2026-01-23);

[Affected Platforms]:

• Windows 10 x64;

[Prerequisites]:

• Be enrolled into the experiment;
• Have VPN ON;
• Have wikipedia.org added to the exclusion list in about:preferences#privacy;

[Steps to reproduce]:

1. Write wikipedia.org in the URL.
2. Click the VPN toolbar icon.

[Expected result]:
The VPN is ON, the “Use VPN for this site” toggle is OFF. The website is excluded from protection.

[Actual result]:
The VPN is ON, the “Use VPN for this site” toggle is still ON. The website is NOT excluded from protection.

[Notes]:
Same applies for Mullvad, if we add www.mullvad.net in about:preferences, and navigate to mullvad.net, the website is still protected.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: Bug 2012113 - IP Protection: relax permission check for site exclusion

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/a5292cbca6b0
https://hg.mozilla.org/integration/autoland/rev/12175eece4ac
IP Protection: relax permission check for site exclusion r=ip-protection-reviewers,fchasen

Comment 3

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/12175eece4ac

Comment 4

[Valentina Virlics [:vvalentina], VPN QA]

Verified this using Firefox Nightly 149.0a1 (25-01-26) on Windows 10.
The issue still reproduces for the scenario metioned under the notes section. If we add "www.mullvad.net" in about:preferences, and navigate to mullvad.net, the website is still protected.
Reopening.

Comment 5

[Valentina Virlics [:vvalentina], VPN QA]

This is also visible while changing the site preferences from the main panel, and VPN ends up in a weird state: "Use VPN for this site" toggle on, and "VPN is OFF for this site" general status. Attaching ss.

Comment 6

[Valentina Virlics [:vvalentina], VPN QA]

Attachment: image (20).png

Comment 7

[kpatenio]

(In reply to Valentina Virlics [:vvalentina], VPN QA from comment #5)

This is also visible while changing the site preferences from the main panel, and VPN ends up in a weird state: "Use VPN for this site" toggle on, and "VPN is OFF for this site" general status. Attaching ss.

Hi Valentina,

Thanks for flagging the inconsistent state. Could you please file a new bug for the issue?

Comment 8

[Valentina Virlics [:vvalentina], VPN QA]

I am not able to reproduce the scenario I mentioned above. If will encounter it again, will track it separately.

Comment 9

[Valentina Virlics [:vvalentina], VPN QA]

I have clear steps to reproduce the above mentioned issue. Tracked it separately, as suggested - https://bugzilla.mozilla.org/show_bug.cgi?id=2016676 - even if seems like it might have the same root cause.

Comment 10

[kpatenio]

(In reply to Valentina Virlics [:vvalentina], VPN QA from comment #9)

I have clear steps to reproduce the above mentioned issue. Tracked it separately, as suggested - https://bugzilla.mozilla.org/show_bug.cgi?id=2016676 - even if seems like it might have the same root cause.

Great, thank you! The lack of validation for the URLs in the site exclusions dialog in about:preferences is causing problems for this bug and Bug 2016676.

Comment 11

[kpatenio]

I'm going to close this ticket as FIXED to acknowledge Baku's original patch. Implementing any form of URL validation for the about:preferences dialog is currently out of scope. We've reverted the changes in Bug 2016676 to prevent problems where a subdomain not registered in the site exclusions list can't be removed as a site exclusion on the panel.

See this comment for more information.

Comment 12

[Valentina Virlics [:vvalentina], VPN QA]

Verified this on Firefox Nightly 149.0a1 (22-02-2026) using Windows 11. The issue still reproduces currently while adding wikipedia.org (without www) and www.mullvad.net (with www) in about:preferences. This was fixed at some point for websites that were added without "www". Did we also reverted that initial change?

Comment 13

[kpatenio]

(In reply to Valentina Virlics [:vvalentina], VPN QA from comment #12)

Verified this on Firefox Nightly 149.0a1 (22-02-2026) using Windows 11. The issue still reproduces currently while adding wikipedia.org (without www) and www.mullvad.net (with www) in about:preferences. This was fixed at some point for websites that were added without "www". Did we also reverted that initial change?

Hi Valentina,

Yes, that's correct. Baku's patch fixed the original issue reported in this bug, but I reverted the initial change via Bug 2016676. This means that the reported issues with omitting www for URLs will still occur with the current Nightly build.