923655 - Explicitly typing 'http' into the URL bar, Firefox tries https instead

Status: RESOLVED INVALID

(Firefox :: Address Bar, defect)

Description

[John Regan]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20130910160258

Steps to reproduce:

I run a web server that serves both https content and http content. The https site is running on port 443, the http site is running on port 8081.

In one tab, I have an https site open.

I open a new tab, and type 'http://domain.com:8081' into the URL bar and hit enter.


Actual results:

The URL bar switches to 'https://domain.com:8081' and fails to retrieve content.


Expected results:

Since I typed 'http', Firefox should try opening a normal http connection, not https.

Comment 1

[Loic]

Probably a dupe of inline autocomplete.

Comment 2

[Marco Bonardo [:mak]]

well, if you type the "http" part of the url, it's not inline autocomplete, we don't change typed protocols. Do you axtually type the whole non-secure url, just a part of it?

Comment 3

[John Regan]

I'm typing the entire URL

Comment 4

[Marco Bonardo [:mak]]

then it seems unlikely that's inline autocomplete
could you try to check the network requests log in the web console? do we immediately and only try to get the secure version?

Comment 5

[John Regan]

It looks like it.

After typing the URL and hitting enter, I see the "http://" part of the URL disappear for a second, then the URL changes to "https://" and in the network log in the web console, I only see the https request

Comment 6

[Marco Bonardo [:mak]]

I don't seem to be able to reproduce the problem here.
Could you provide steps to repduce in a new profile, so that we can try reproducing starting from a clean environment?

You see this issue on Firefox 24, right?

Comment 7

[John Regan]

I made a new profile and was able to reproduce the error.

I visited the http site from a clean profile, and it worked fine.

I then visited the https site.

Afterwards, trying to get to the http site no longer works, Firefox is defaulting to https.

The https site and http site are running on different ports, and entirely different sets of software - the https site is running on nginx, the http site is a python script.

One thing I can think of - I set the Strict-Transport-Security header to includeSubDomains on the https site - but I would imagine connecting on a different port wouldn't be included. I can try changing that and see what happens.

Comment 8

[John Regan]

Here's what I've found.

If I disable sending the Strict-Transport-Security header, everything works fine.

If I send the Strict-Transport-Security header (with or without "includeSubdomains"), it breaks.

While both sites are on the same domain, they're running on different ports - and I'm explicitly requesting Firefox to access the http site using http. I'm not sure if this is an error on my part (maybe I should only enable Strict-Transport-Security on certain subdomains), or on Firefox.

Comment 9

[John Regan]

After reading the HSTS spec, it looks like it was an error on my part - HSTS is supposed to apply to the whole host, including all ports.

Feel free to close this bug

Comment 10

[Marco Bonardo [:mak]]

thank you for your investigation, closing.