676597 - Firefox silently connect to HTTPS when browsing on a HTTP only site

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[Law, Cheuk-wing]

Attachment: The certificate error dialog

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.30 (KHTML, like Gecko) Ubuntu/11.04 Chromium/12.0.742.112 Chrome/12.0.742.112 Safari/534.30

Steps to reproduce:

My own web server offers contents on both HTTP and HTTPS. The certificate is self-signed. I browse on the HTTP part of the server to a static HTML file which contains only a hyperlink to the HTTPS part.


Actual results:

Firefox display a dialog which shows that the certificate is self-signed and not trusted even though I am not browsing on HTTPS. The results are the same when I launched Firefox in safe mode.


Expected results:

Firefox should not silently connect to HTTPS.

Comment 1

[Justin Dolske [:Dolske]]

I can't think of anything obvious that would be doing this. If you remove the link in the HTML does it still happen? Do you have any addons which might be trying to prefetch things? (Start in Safe Mode to temporarily disable them -- http://support.mozilla.com/en-US/kb/Safe%20Mode).

Comment 2

[Law, Cheuk-wing]

(In reply to comment #1)
> I can't think of anything obvious that would be doing this. If you remove
> the link in the HTML does it still happen? Do you have any addons which
> might be trying to prefetch things? (Start in Safe Mode to temporarily
> disable them -- http://support.mozilla.com/en-US/kb/Safe%20Mode).

I have another similar page which don't contain HTTPS links.
But here are something new I have just discovered:
 - It only happens when it is the first time to visit the server in a session. To trigger the dialog again, I need to restart Firefox.
 - The dialog will popup twice after the page is loaded.
 - The dialog will also popup every time I switch back to the page's tab.
 - The dialog will NOT appear after navigating to other pages and back.

Comment 3

[Law, Cheuk-wing]

I found that the dialog is caused by loading "favicon.ico" which is accidentally redirected to the HTTPS site. After correcting the redirection, the dialog no longer appear.

Comment 4

[Virgil Dicu [:virgil] [QA]]

Mozilla/5.0 (X11; Linux x86_64; rv:9.0a1) Gecko/20110915 Firefox/9.0a1

Setting to Resolved then based on Comment 3.