477826 - EV-Cert shows during page load and either disappears after page has loaded or after a hard-refresh

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect, P2)

Description

[u88484]

The EV-Cert shows during page load and either disappears after page has loaded or after a hard-refresh.

STR:
1) Go to https://www.usaa.com/inet/ent_logon/Logon
2) Watch the page while loading and see the EV-Cert display (sometimes it
disappears when the page is done loading)
3) If EV-Cert is still showing after the page is done loading, hit refresh,
EV-Cert still shows
4) Hit CTRL+F5 for a hard-refresh and the EV-Cert doesn't show up and says
the site does not supply identity information.

Comment 1

[u88484]

I tried to get a log following the steps outlined on http://www.mozilla.org/projects/netlib/http/http-debugging.html but the log does not get created.  Is there different steps for Vista?  I see the page says it hasn't been updated since 2004 and judging by the install location of mozilla.org I'd say that is correct.

And yes, I followed the steps exactly and I have Vista set to show all hidden files.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I assume you set the NSPR_LOG_FILE to a filename/directory that you have write access to?  And that you ran firefox.exe, not mozilla.exe?

If so, I have no idea what you're seeing.  The directions workforme (on Vista) and for everyone else who's tried them recently....

Comment 3

[u88484]

(In reply to comment #2)
> I assume you set the NSPR_LOG_FILE to a filename/directory that you have write
> access to?  And that you ran firefox.exe, not mozilla.exe?
> 
Yes and Yes
> If so, I have no idea what you're seeing.  The directions workforme (on Vista)
> and for everyone else who's tried them recently....
I have no clue.  I've tried everything I can think of.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Does the file not get created at all, or is it empty?

Can I see the exact commands you ran?

Comment 5

[u88484]

(In reply to comment #4)
> Does the file not get created at all, or is it empty?
> 
> Can I see the exact commands you ran?

Doesn't get created at all.

cd c:\
set NSPR_LOG_MODULES=nsSecureBrowserUI:5
set NSPR_LOG_FILE=C:\log.txt

cd c:\junk\firefox\
.\firefox.exe

that is what is in my batch file.  I did basically the same without the batch file but instead of cd c:\ i did cd .. twice to get to c:\

I have even tried different folders that I write to all the time without luck

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Try this variation on the steps in the page cited in comment 1:
Instead of:
set NSPR_LOG_FILE=C:\log.txt
try
set NSPR_LOG_FILE=%HOME%\My Documents\log.txt

And, of course, if you're running Firefox, then instead of the commands

cd "Program Files\mozilla.org\Mozilla"
.\mozilla.exe

try

cd "C:\Program Files\Firefox"   (or wherever your copy of firefox.exe lives)
start .\Firefox.exe

If that works better for you, let us know and I will edit the page.

Comment 7

[u88484]

Attachment: Log using nsSecureBrowserUI:5

I'm not sure if the first two lines are relevant because I edited the file to take out which ever Firefox start page loaded when I loaded the browser.  So, I'm not sure if those two lines went with the last entry of mozilla stuff or with the usaa stuff.

Comment 8

[Boris Zbarsky [:bzbarsky]]

0[82c140]: SecureUI:468f240: b70ab4 54f2fa0 OnStateChange 10010 https://content.usaa.com/mcontent/static_assets/Media/thmb_rotatingBnr_1.gif?cacheid=2406890540
0[82c140]: SecureUI: GetSecurityState: - no nsITransportSecurityInfo for 0
0[82c140]: SecureUI:468f240: OnStateChange: subreq INSECURE
0[82c140]: SecureUI:468f240: UpdateSecurityState:  old-new  4 - 2

Looks similar to the log issue in bug 472986.

Comment 9

[Johnathan Nightingale [:johnath]]

Dupably similar, Boris?

Comment 10

[Boris Zbarsky [:bzbarsky]]

I don't know.  I think the right approach is to get a patch for either bug going and see if it fixes the other one, then dupe or not based on that.

Comment 11

[Michael K]

(In reply to comment #10)
> I don't know.  I think the right approach is to get a patch for either bug
> going and see if it fixes the other one, then dupe or not based on that.

Keep me updated if this is related - and let me know if I can assist here as I originally reported bug 472986.

Comment 12

[u88484]

Just to note, this doesn't happen on IE7...the EV certificate shows on this site with no problem.

(In reply to comment #6)
> Try this variation on the steps in the page cited in comment 1:
> Instead of:
> set NSPR_LOG_FILE=C:\log.txt
> try
> set NSPR_LOG_FILE=%HOME%\My Documents\log.txt
> And, of course, if you're running Firefox, then instead of the commands
> cd "Program Files\mozilla.org\Mozilla"
> .\mozilla.exe
> try
> cd "C:\Program Files\Firefox"   (or wherever your copy of firefox.exe lives)
> start .\Firefox.exe
> If that works better for you, let us know and I will edit the page.

Yeah, creating the log to C:\ fails but to a different folder it worked (but only when I either created a batch file with

cd c:\junk\firefox\
.\firefox.exe

or when using command prompt to manually enter the info.  Not when using the desktop shortcut or manually opening firefox.exe.  Weird.

Comment 13

[Daniel Veditz [:dveditz]]

(In reply to comment #12)
> [It didn't work] when using the desktop shortcut or manually opening
> firefox.exe.  Weird.

When you set environment variables in a command shell they're only set for that shell. Running a separate desktop shortcut for Firefox will only pick up the global environment variable settings.

Comment 14

[Boris Zbarsky [:bzbarsky]]

Kurt, would you be willing to retest in tomorrow's trunk nightly?  That should have bug 472986 fixed...

Comment 15

[Jim Jeffery not reading bug-mail 1/2/11]

The EV Cert no longer disappears for me using the latest hourly.  Not having used this site before, I'm curious why when refreshing the page I'm seeing a warning dialog box about 'resending' data...

"To display this page, Minefield must send information that will repeat any action (such as a search or order confirmation) that was performed earlier."

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20090216 Minefield/3.2a1pre Firefox/3.0.4 ID:20090216071006

Comment 16

[Jim Jeffery not reading bug-mail 1/2/11]

Curious, after posting above, I went back to the tab with the URL in bug, and now no longer see the 'resend data' dialog box.

Comment 17

[u88484]

(In reply to comment #15)
> The EV Cert no longer disappears for me using the latest hourly. 
It still disappears for me with 20090216042918 build
http://hg.mozilla.org/mozilla-central/rev/b5359ab6a52c

> Not having used this site before, I'm curious why when refreshing the page
> I'm seeing a warning dialog box about 'resending' data...
> "To display this page, Minefield must send information that will repeat any
> action (such as a search or order confirmation) that was performed earlier."

I see this also until I switch tabs and come back then refresh. I was using the 20090213 build before I upgraded this morning and also seen this dialog but it wasn't there when I found and reported this bug.  So I'm not sure if something changed between the 20090210 build and the 20090213 build but the recent checkin for bug 455367 is not he culprit since I tested before upgrading to the 16ths build.

Comment 18

[u88484]

(In reply to comment #17)
> (In reply to comment #15)
> > The EV Cert no longer disappears for me using the latest hourly. 
> It still disappears for me with 20090216042918 build
> http://hg.mozilla.org/mozilla-central/rev/b5359ab6a52c

Ignore this.  Helps if I use a build with the patch included.  Verified fixed using the 20090216092009 hourly build.

> > Not having used this site before, I'm curious why when refreshing the page
> > I'm seeing a warning dialog box about 'resending' data...
> > "To display this page, Minefield must send information that will repeat any
> > action (such as a search or order confirmation) that was performed earlier."
> 
> I see this also until I switch tabs and come back then refresh. I was using the
> 20090213 build before I upgraded this morning and also seen this dialog but it
> wasn't there when I found and reported this bug.  So I'm not sure if something
> changed between the 20090210 build and the 20090213 build but the recent
> checkin for bug 455367 is not he culprit since I tested before upgrading to the 16ths build.

I do still see this though

Comment 19

[u279076]

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1pre) Gecko/20090604 Shiretoko/3.5pre

Verified fixed.  I still see the resend alert, but I think this is expected.  If it's not expected, this is probably a different bug.

Comment 20

[u279076]

Added test case in litmus: https://litmus.mozilla.org/show_test.cgi?id=7779