902586 - Re-enable Protection option for Mixed Content Doorhanger

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[Tanvi Vyas[:tanvi]]

There has been a request to have a way for the user who has disabled protection on a page to re-enable protection on a page.  To do this right now, the user has to simply reload the page, but they aren't aware of that.

I'm not sure what the UI would look like for this.  If a user "Disables Protection" the shield (a symbol of protection) disappears and they see a yellow warning triangle.  In order for them to re-enable protection, they need a doorhanger or something they can click on that expands and provides the re-enable option.  I don't think we should persist the Sheild Doorhanger because that will be a confusing message to the user (a sheild positive indicator next to a warning negative indicator).  Maybe we can make the re-enable protection option in the Site Identity Box**.  Or we could add a new doorhanger that isn't a positive indicator that a user can click on and re-enable protection.

Or we could just punt on this problem all together and hope that the user figures out they can re-enable protection by reloading the page or opening a new tab/window.

Thoughts are welcome!

** The Site Identity Box really needs a makeover.  Hence, it will be difficult to add a new option to it without bikeshedding on the existing design.  This proposal is to add it to the existing box.  If that's not going to fly, then let's skip that idea, as I don't want this bug to turn into a revamp of the whole box - that is a much larger project that is outside the scope of this bug.

Comment 1

[Tanvi Vyas[:tanvi]]

Today we had a meeting about Mixed Content Blocker and the ability to "Disable Protection for This Session" instead of "on This Page".  We could change the meaning of "Disable Protection on This Page" to last for a full session instead of a single load.  But if we did this, we'd need a way to re-enable protection.  Without this, the only way for the user to re-enable protection would be to restart the browser.

The backend implementation to re-enable protection would be pretty easy.  It is the UI to re-enable protection that is difficult.  Hoping that we can get some UI help on this.  Can we add it to the Site Identity Box?  I've just learned that there is work in progress on revamping the Site Identity Box.  When is that scheduled for (what Firefox version)?  Do we need to wait for the revamp in order to add the "re-enable protection" button to the box?

Comment 2

[Jonathan Kingston [:jkt] he/him]

This looks like this is now fixed by looking at https://mixed-script.badssl.com/ I can renable in the site identity box.

:tanvi am I understanding this bug correctly that we now implement this?

Thanks

Comment 3

[Tanvi Vyas[:tanvi]]

Yes, this was fixed years ago. Thanks Jonathan!