78832 - Page Info security status not available right away

Status: VERIFIED DUPLICATE of bug 148610

(Core Graveyard :: Security: UI, defect, P3)

Description

[Bob Lord]

When you are in the process of loading a secure web page, click on the lock
icon.  Even though the HTML page is loaded, the Page Info status will
incorrectly report that this page is not protected by SSL.

This problem is more obvious when you are using a modem.

Comment 1

[Terry Hayes]

This is true.  The security information about the page (as it is defined now) is
not complete until the document finishes loading.  This is partly due to our
definition of security: all frames and all contents must be loaded securely for
the page to be secure, and partly due to the way the document loader functions
(the notifications of page activity).

There are three possible solutions:
1) Change the way security is computed.  We can decide on the security as soon
as the SSL handshake for the main page is complete.
2) Delay opening the page info until reliable data is available (HARD)
3) Update the page info on the fly as new data is available (somewhat HARD)

Or we can just live with the current "wait until it's loaded" method.

Comment 2

[John G. Myers]

I tend to lean towards (1).  The current definition is a bit too pedantic.  I 
don't even think the code gets notification of abnormally closed connections.

Comment 3

[Terry Hayes]

I think the information that is displayed by the page info window should match
the state of the icon when it is clicked.  It would be confusing if clicking an
"open" lock (halfway through page load) brought up a window that says the page
is secure.

Comment 4

[Joeri Alberty]

When i load the page https://mail.yahoo.com click "page info" or the open lock 
it says "connection not encrypted".
Is this normal or a bug in build 2001052908 Linux.
In mozilla 0.9 the lock closes when the page was loaded.

Comment 5

[John G. Myers]

We need a policy decision here.  Do we want to switch the lock icon to locked 
when the page starts loading or do we want to keep the current behavior of 
switching it only when the load is complete?

Comment 6

[Aleksey Nogin]

The Joeri's comment has nothing to do with policy decision - I see the same
thing (build id 2001052819 on RedHat Linux 7.1) - the lock stays open and Page
Info says "not encrypted" _even when the page is finished loading_.

Comment 7

[John G. Myers]

If the lock icon doesn't appear after the page has finished loading, that is a 
separate bug.

Comment 8

[David P. Drinan]

-> p2

Comment 9

[Stephane Saux]

Mass reassigning target to 2.1

Comment 10

[Stephane Saux]

->kai
p3

Comment 11

[Stephane Saux]

Moving all P3 and P4 bugs targetted to 2.1 to future.

Comment 12

[Stephane Saux]

removing nsenterprise keyword from PSM bugs with target milestone of future.

Comment 13

[John Unruh]

Mass assigning QA to ckritzer.

Comment 14

[(Don't use, old account) - Kai Engert]

Changing my prefered e-mail address.

Comment 15

[Kai Engert [:KaiE:]]

I think this is now fixed.


*** This bug has been marked as a duplicate of 148610 ***

Comment 16

[John Unruh]

Verified dupe.