898399 - Doorhanger is displayed only at first loading of https://koding.com/ using new profile

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Mihai Morar, (:MihaiMorar)]

This is happening on Windows 7 x64 and Ubuntu 12.10 x86 using FF 23b9.
STR:
1. Create a new profile and open FF 23b9
2. Go to https://koding.com/
3. Refresh the page

Actual Results:
After step2 the doorhanger is displayed.
After step3 the doorhanger is not diplayed any more.

Expected Results:
After both step 2 and 3 the doorhanger must be displayed.

Comment 1

[Mihai Morar, (:MihaiMorar)]

Tanvy, can you please confirm this is indeed a bug or not ?

Comment 2

[Tanvi Vyas[:tanvi]]

It sounds like the mixed content attempts to load the first time, and then never again after.  I will take a look.

Comment 3

[Mihai Morar, (:MihaiMorar)]

(In reply to Tanvi Vyas [:tanvi] from comment #2)
> It sounds like the mixed content attempts to load the first time, and then
> never again after.  I will take a look.

Something like that.

Comment 4

[Tanvi Vyas[:tanvi]]

I created a new Firefox profile and opened https://koding.com.  I got the Mixed Content Blocker shield and see that the following content is blocked:

Blocked loading mixed active content "http://player.vimeo.com/v2/receiver.html" @ https://secure-a.vimeocdn.com/p/2.0.11/js/player.js:201

I disabled protection.  It changed the lock to a globe, implying that Mixed Display Content loaded.  But it did not change it to a triangle (for Mixed Active Content) and I don't see any messages about Mixed Active Content loading in the webconsole.  "Disabling protection" acts similarly to a page refresh, so it's not surprising that the second load doesn't have mixed content.

I checked my cookies, and some cookies were set for koding.com.  I close the window, clear my cookies, and again visit https://koding.com.  I see the Mixed Content Blocker.  So the content that is blocked has something to do with my cookies.

I close the window again, clear my cookies, and this time turn off Mixed Active Blocking through about:config.  I got https://koding.com and the mixed active content loads this time:

GET http://player.vimeo.com/v2/receiver.html [HTTP/1.1 200 OK 939ms]

I refresh, and I see the lock instead of the globe (no mixed content).

In conclusion, there must be some active content that only runs for users when they don't have cookies yet.  Also, I don't see a difference in functionality of the page.  I'm not too worried about this.

Comment 5

[Mihai Morar, (:MihaiMorar)]

Thanks Tanvi! For now, marking this as Resolved Invalid.

Comment 6

[Tanvi Vyas[:tanvi]]

Is there mixed content elsewhere on the page?  Like after you login?