939455 - Cached mobile-specific elements are used when switching between mobile and desktop view (avoid evil mobile-only redirects)

Status: RESOLVED INCOMPLETE

(Firefox for Android Graveyard :: General, defect)

Description

[Gábor Stefanik]

Recently, I've came across a few sites that try to bypass "Request desktop site" in a rather nasty way:
First, an inline script is used to create another <script> element that loads an off-site JavaScript file, which in turn creates an iframe. The page in the iframe contains another off-site script, which is an empty file if accessed with a desktop User-Agent, but does a top.location = (mobile version of the page) if a mobile User-Agent is found.

Apparently, this way of loading the redirect script causes Firefox to cache it, so even after "Request desktop site" is pressed, the site still "knows" (due to the cached script) that it is in fact loaded on a mobile device, and displays the mobile version. (Some sites outright redirect to a page containing only ads when a mobile browser is detected - such sites are completely impossible to load on Firefox for Android.) Even pressing Back (to get back to the pre-redirect page), quickly stopping the page from loading, and pressing Refresh to clear the cached data doesn't help - only emptying the cache works.

A possible fix would be emptying the cache whenever the user switches between mobile and desktop mode (but this would require making desktop mode an app-wide preference, rather than a per-tab one as it is now); or tagging cache entries either with the mode they were originally loaded in, or with the User-Agent header that was sent on original load, to ensure that when the mode or the User-Agent string is changed, no data with wrong mode/User-Agent is retrieved from the cache. In other words, Firefox should only display cached data if it was originally downloaded with the same User-Agent that is in use at the moment. Maybe a simpler version of this would be having separate caches for mobile and desktop content.

Comment 1

[BMO Automation]

We have completed our launch of our new Firefox on Android. The development of the new versions use GitHub for issue tracking. If the bug report still reproduces in a current version of [Firefox on Android nightly](https://play.google.com/store/apps/details?id=org.mozilla.fenix) an issue can be reported at the [Fenix GitHub project](https://github.com/mozilla-mobile/fenix/). If you want to discuss your report please use [Mozilla's chat](https://wiki.mozilla.org/Matrix#Connect_to_Matrix) server https://chat.mozilla.org and join the [#fenix](https://chat.mozilla.org/#/room/#fenix:mozilla.org) channel.