2019611 - New "Looks like there’s a problem with this site" page shows error for the wrong host to which it hasn't tried to connect

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[наб]

Attachment: a.png

Steps to reproduce:

Follow a link to http://www.hpl.hp.com/techreports/tandem/TR-85.7.html

Actual results:

As reproduced in the attachment:

Looks like there’s a problem with this site

Nightly can’t connect to the server at hp.com
What can you do about it?

Try connecting on a different device. Check your modem or router. Disconnect and reconnect to Wi-Fi.

Expected results:

The page should show the error that actually caused the page to fail loading instead of a different one which doesn't appear to have actually happened?

Accd'g to F12, the request was to www.hpl.hp.com, which is as-expected. I don't see any history of an hp.com request, so I'm not sure why this error page is trying to gaslight me into thinking there was one?

Or mayhap there was a spurious hp.com request and the browser hid it from me? Much to think about!

Either way, the browser should either (a) not be doing that request or (b) brand the hostname it tried to connect to into the error page instead of deliberately misleading the user and whoever may be downstream of the user.

Nightly 150.0a1 (2026-02-24) (64-bit) and 150.0a1 (2026-02-26) (64-bit)

Comment 1

[Francesco Lodolo [:flod]]

I don't think that's incorrect, given that the host name for that URL is hp.com, but letting Security folks triage.

Comment 2

[наб]

Attachment: host name.png

The host name for that URL is www.hpl.hp.com. We know this because that's where the host name goes in the URL (cf. https://datatracker.ietf.org/doc/html/rfc1738#section-3.1), and we know this because that's what the network tab tells us (cf. attachment "host name.png").

Comment 3

[Manuel Bucher [:manuel]]

This is a change in error messaging from the security.certerrors.felt-privacy-v1. Confirming, that this is indeed a change in messaging on the error page.

previous:

The server at www.hpl.hp.com is taking too long to respond.

new:

Nightly can’t connect to the server at hp.com

This looks like an unintended change due to other errors still showing the full origin.

@jbuck: Is this an intentional change and if so do we have reasoning documented somewhere, or is this something that should be addressed by going back to show the full origin?

Comment 4

[Manuel Bucher [:manuel]]

Attachment: previous-design.png

Comment 5

[Manuel Bucher [:manuel]]

And looking at the previous design, the information about connection time out is also missing?

Comment 6

[Jack Brown]

Attachment: Bug 2019611 - Fix netTimeout error to use correct l10n IDs and whole origin with subdomains - r?niklas

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/a729ef7f53b9
https://hg.mozilla.org/integration/autoland/rev/7a02c40691b2
Fix netTimeout error to use correct l10n IDs and whole origin with subdomains - r=niklas,fluent-reviewers,bolsson,desktop-theme-reviewers,sfoster

Comment 8

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/7a02c40691b2

Comment 9

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: Users who encounter a network timeout on any site with subdomains will see an incomplete hostname on the error page. For example, on www.hpl.hp.com, the error page would mention only hp.com. The patch also includes more troubleshooting information for the network timeout error.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Changes are confined to the net error page UI (localization strings, error config, card rendering component).

It adds a new rendering path for list items on error pages.

• String changes made/needed?: Yes, one new string: fp-neterror-net-timeout-intro in toolkit/neterror/netError.ftl. It has been reviewed and accepted by fluent-reviewers (r=bolsson). The string is self-contained and does not depend on any other new strings.
• Is Android affected?: no

Comment 10

[Jack Brown]

Attachment: Bug 2019611 - Fix netTimeout error to use correct l10n IDs and whole origin with subdomains -

Original Revision: https://phabricator.services.mozilla.com/D285332

Comment 11

[Pascal Chevrel (relman team) -> :pascalc|PTO until Sept 2]

Bryan, can we uplift this one with the string change? In case it matters, we updated translations on release today in bug 2028335.

Comment 12

[Bryan Olsson [:bolsson]]

This has only been available for localization for 2 weeks or so and there's still a number of locales where this hasn't been translated. Considering it's included in 150, we should allow at least one cycle to ensure we get more translations before exposing this string to users.

Comment 13

[Pascal Chevrel (relman team) -> :pascalc|PTO until Sept 2]

Comment on attachment 9562434 [details]
Bug 2019611 - Fix netTimeout error to use correct l10n IDs and whole origin with subdomains -

Not taking for the dot release as it is adding new UI not yet translated.

Comment 14

[Mathew Hodson]

Last good revision: 3ace307f44a058fd8f0836bf7c9252062f861acd
First bad revision: 2b825e14f742a113f46d8ec9c6aecdeee35087cb
Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3ace307f44a058fd8f0836bf7c9252062f861acd&tochange=2b825e14f742a113f46d8ec9c6aecdeee35087cb

Comment 15

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2009206