280322 - Firefox ignores http header status returned from a GET request

Status: RESOLVED INVALID

(Core :: Networking: HTTP, defect)

Description

[Rod French]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

I had a bug in a development web site of mine (now fixed).  I set the http
status to 403 (forbidden) but still sent some plain text back in the response.
Firefox displayed the text with no indication that the status was something
other than 200 OK
When someone else hit this site with MSIE they got no text displayed - just the
standard Microsoft 403 Forbidden message.

Should Firefox make more effort to indicate the http status (if abnormal)?
Showing the response if present is fine but NOT indicating the 403 status got me
very confused!


Reproducible: Always

Steps to Reproduce:
1. make a web page return status of 403 but send plain text response of "hello
world" as well.
2. Hit this web site with Firefox.
3.  Hit it with MSIE
4. Observe the difference!

Actual Results:  
Firefox displays text
MSIE displays 403 forbidden

Expected Results:  
Firefox should display 403 forbidden

Comment 1

[Josh Birnbaum]

Do you have IE's "Show friendly HTTP error messages" enabled (under Options,
Advanced)?  Without a testcase, that would be my guess for the difference
between IE and Firefox.

Displaying "403 Forbidden" is only useful to the small handful of us that know
what that means.  Much better in my mind to show what the website sent, which
hopefully provides details on what happened, how to get access, etc.

Comment 2

[Boris Zbarsky [:bzbarsky]]

If the site returns an error page with the error response, we should show that
error page, without adulterating it.  Sites often use the error page to
communicate information to their users...

Note that IE will either display the error page or not based on how long the
content of the error page happens to be.  That's not really something we want to
emulate.