756990 - SSL certificate details not shown when following link, but works when entering URL/opening new tab/reloading

Status: RESOLVED INVALID

(Core Graveyard :: Security: UI, defect)

Description

[Jens Bannmann]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0
Build ID: 20120420145725

Steps to reproduce:

1. Open <http://www.alsoactebis.com/ec/cms2/de/1010/content/start.jsp>
2. Left-click the green arrow-shaped link on the right side labeled 'Kundenlogin' (= customer login)
-> Redirect to <https://www.alsoactebis.com/ec/cms2/1010/Login.do>, the login form.
3. Click Firefox's web site identity button
4. Reload the page.
5. Click Firefox's web site identity button


Actual results:

Before the reload, Firefox claims that parts of the page were not encrypted. However, after the reload it displays the identity data of the SSL certificate. The latter also happens when entering the URL <https://www.alsoactebis.com/ec/cms2/1010/Login.do> directly or when opening the 'Kundenlogin' link in a new tab (middle mouse button).


Expected results:

Firefox should display display the same behaviour regardless of how the page is loaded (link click, reload, new tab, entering the URL). I presume it is correct to show the parts-not-encrypted warning and in consequence not to indicate an SSL connection.

Comment 1

[Jens Bannmann]

I found out that a third-party script behaves differently before and after the reload, fetching a resource from another server via http the first time and via https the second time. I think that this causes the parts-not-encrypted warning, but I don't know yet why it behaves differently.

Please ignore this bug until I can verify whether the script is the cause.

Comment 2

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Jens, should we close this bug report?

Comment 3

[Jens Bannmann]

I was not able to find out why that script behaved differently, but I am reasonably sure that it was the cause - so after all, this is not a bug in Firefox.

I forgot about this report, sorry for leaving it open this long.