258376 - Leaving SSL page warning dialog may appear too late

Status: RESOLVED WORKSFORME

(Core :: Networking: HTTP, defect)

Description

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Leaving SSL page warning dialog may appear too late

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616

To reproduce:

1. Make sure that Edit > Preferences... > Privacy & Security > SSL > "Leaving a
page that supports encryption" option is on.
2. Go to a non-https page that has a link to an https page, for example
http://www.techcu.com/
3. Click on an https link, for example "SIGN ON".
4. Go back one page (or click on some non-https link). Notice that you will get
a warning about leaving a secure page before actually leaving, so you can kill
the browser if you are feeling paranoid. Click ok.
5. Go forward one page.
6. Go back one page. Notice that this time the new page will display, and you
will be presented with the warning about leaving the secure site after the fact.
While the warning dialog is up, the URLbar shows the http URL, but the padlock
shows the secure state.

This does not happen 100% for me, maybe 80% or so. Try the backward/forward
sequence until you see this.

This might be caused by, or be related to, bug 258048 or bug 257308.

Comment 1

[Daniel Veditz [:dveditz]]

Not an exploit, removing confidential flag. The primary purpose of the dialogs,
as a warning so people don't submit things in the new page in the clear, is
still being met.

Comment 2

[Darin Fisher]

Is this fixed now that we show the dialogs when first transitioning to a
(in)secure site?  I expect that it is.

Comment 3

[Kai Engert [:KaiE:]]

also see bug 62178

Comment 4

[Heikki Toivonen (remove -bugzilla when emailing directly)]

This seems to be working now (or at least I am unable to reproduce this).