840682 - Use HTTPS instead of HTTP in the links to crash reports in about:crashes

Status: VERIFIED FIXED

(Toolkit :: Crash Reporting, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #771788 +++

The default breakpad.reportURL is http://crash-stats.mozilla.com/report/index/

Crash reports contain personally identifiable information and we should send them over HTTPS.

https://crash-stats.mozilla.com already supports HTTPS so this might be a very simple change to make.

(This was reported to a user as part of Bug #771788. I'm just splitting that bug up into separate bugs.)

Comment 1

[(not currently active) Ted Mielczarek]

breakpad.reportURL is only used to generate the links to crash reports in about:crashes. The data is POSTed to the ServerURL from application.ini:
http://mxr.mozilla.org/mozilla-central/source/build/application.ini#44

Comment 2

[:Gavin Sharp [email: [e-mail]]]

(In reply to Ted Mielczarek [:ted.mielczarek] from comment #1)
> breakpad.reportURL is only used to generate the links to crash reports in
> about:crashes. The data is POSTed to the ServerURL from application.ini:
> http://mxr.mozilla.org/mozilla-central/source/build/application.ini#44

Since http://crash-stats.mozilla.com/ seems to redirect to https anyways, is there any reason not to link directly to https rather than http?

Comment 3

[(not currently active) Ted Mielczarek]

That's fine, but this bug is pretty confused.

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Ted, thanks for correcting me. I agree the bug is confusing as reported. I corrected the summary, at least. I agree with Gavin that we might as well use https:// links since the site is doing the redirect to https:// anyway.

Comment 5

[Raymond Lee [:raymondlee]]

Attachment: v1

Comment 6

[Raymond Lee [:raymondlee]]

Attachment: Patch for check-in

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f56acd2dc690

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f56acd2dc690

Comment 9

[Eldmannen]

Can you fix all the other HTTP links so they go to HTTPS too?

Comment 10

[:Gavin Sharp [email: [e-mail]]]

We're tracking that in bug 771788.

Comment 11

[Camelia Badau [:cbadau], Desktop Test Engineering]

Verified fixed on Windows 7 64bit, Ubuntu 13.10 and Mac OSX 10.8.5 using latest Nightly 34.0a1.