900465 - Unable to use Facebook app with mixed-content-blocked-notification-icon enabled

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[Ioana Chiorean]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/28.0.1500.52 Chrome/28.0.1500.52 Safari/537.36

Steps to reproduce:

1. go to https://www.facebook.com/INGWebCafe?sk=app_630984243598042&app_data=fbapp/articol/sibiu-53 
2. Click on one photo 


Actual results:

I am unable to parse the photos in the app


Expected results:

I should be able to see the photos one by one.

Comment 1

[Ioana Chiorean]

This is ok on Chronium. 

MMAchine: Ubuntu x64 , 12.04

Comment 2

[Alice0775 White]

It works for me if I click mixed-content-blocked-notification-icon and choose "Disable Protection on This Page" (i.e. disable mixed content blocker).

http://hg.mozilla.org/mozilla-central/rev/c2b375f3a909
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20130731 Firefox/25.0 ID:20130731030203

Comment 3

[Tanvi Vyas[:tanvi]]

I can't really figure out what this app does or how it works.  At one point, I'm redirected from the facebook page to a .ro page and then back to facebook.

When it finally did start working, I clicked on a picture that takes me to https://www.facebook.com/INGWebCafe?sk=app_630984243598042&app_data=fbapp/galerie/sibiu-53

I can scroll through the pictures.  I don't see any Mixed Content (active or passive, allowed or blocked) on the page.  No shield icon, no messages in the security pane of the webconsole.  The site identity box shows the lock.

Alice, can you copy/paste the messages you see in the Security pane of the webconsole when the shield icon appears?

Thanks!

Also, I have gotten other reports on my blog about facebook apps breaking.  Facebook apps that rely on HTTP active content will display the Mixed Content Shield Icon.  The apps should be upgraded to support SSL.  The apps are probably already broken in IE and might also be broken in Chrome.  Chrome 30+ will start breaking mixed content iframes (the way IE and Firefox already do).

Comment 4

[Adrian Florinescu [:aflorinescu]]

The link from the initial report is not accessible anymore and I am inclined to say that Facebook nowadays runs most of apps. and redirects everything over to https:// - https://www.facebook.com/notes/facebook-engineering/secure-browsing-by-default/10151590414803920/
If there's anything that could trow off mixed content FF warning in Facebook, I didn't know where to look.
I also had no luck finding the Facebook option to turn secure browsing off, so based on the above reasoning I'm closing this bug as WFM.