958886 - Use HTTPS for amazon.com searches from the search box

Status: VERIFIED FIXED

(Firefox :: Search, enhancement)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #958885 +++
+++ This bug was initially created as a clone of Bug #958873 +++

amazon.com is one of only two remaining pre-installed search engines in the en-US localization that does not support HTTPS for searches. I have experimented with submitting searches to amazon.com such that they get redirected to HTTP. That seems to work, and it would send a nice message to amazon.com that we want searches to be done over HTTPS. As you can see from bug 771788, we're making great progress on making all the in-built functionality in Firefox use HTTPS by default, and this is likely to be a long pole. It would be great to get amazon.com supporting HTTPS, at least for these in-product searches.

Assigning to Kev for now since he's the only person I am familiar with that deals with these sorts of agreements.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Kev, could you please ask amazon.com about this? It would be great to hear from them regarding their timeframe for "real" HTTPS support (not just redirecting HTTPS requests to HTTP) on the site in general and especially for these in-product searches.

Comment 2

[Kev Needham [:kev]]

Believe this is being addressed by BD (mconnor and jnagel... and maybe Sid). These requests should go to Mike and Joanne. Apologies for the long delay in replying.

Comment 3

[Sid Stamm [:geekboy or :sstamm]]

mconnor? Who should we ask about making the amazon search https?

Comment 4

[Joanne Nagel]

Sid, I'm confused, is this a new ask apart from what I'd already researched with Amazon?  I shared their response back on Feb. 28th, are there outstanding questions?  They are fine with us switching to https and provided this feedback:

Firefox most likely has an OSD, similar to the example XML in this article: 
(https://developer.mozilla.org/en-US/Add-ons/Creating_OpenSearch_plugins_for_Firefox),
installed by default on all browsers for showing Amazon search in the search text box. All Mozilla needs to do is update the <Url> element of this OSD (which you presumably received from someone here at Amazon ) and replace the http with https.  We help you with this if you share this OSD with us.

If you need further assistance please let me know what the explicit ask is and I'll coordinate.

Joanne

Comment 5

[Sid Stamm [:geekboy or :sstamm]]

Sorry Joanne... I think I was confused too.  Now that it's in a bug and not an email thread it will be easier for me to find.  :)

So sounds like we just need to rewrite the OSD to use https instead of http and test it, then make sure it gets localized.

http://mxr.mozilla.org/mozilla-central/source/browser/locales/en-US/searchplugins/amazondotcom.xml

Comment 6

[Matthew N. [:MattN]]

Don't forget about mobile: mobile/locales/en-US/searchplugins/amazondotcom.xml

Comment 7

[Richard Barnes [:rbarnes]]

Attachment: bug-958886.0.patch

This patch changes the search plugin and related tests.  Try run ongoing (just running on linux since this shouldn't have platform dependencies):

https://treeherder.mozilla.org/#/jobs?repo=try&revision=7b0bee162b14

As far as landing, I suggest we proceed given the approval above.  We can roll it back if their answer has changed.

Note that right now, the HTTPS search URL returns a 301 to an HTTP URL.  So there is a minor latency hit.  However, I'm told that Amazon is working on removing the 301, so it makes sense to go ahead and get this change on the train so that we can be there when they do.

Comment 8

[Mark Finkle (:mfinkle) (use needinfo?)]

Comment on attachment 8621812 [details] [diff] [review]
bug-958886.0.patch

Don't forget Dre, err, Mobile
http://mxr.mozilla.org/mozilla-central/source/mobile/locales/en-US/searchplugins/amazondotcom.xml

Comment 9

[Richard Barnes [:rbarnes]]

Attachment: bug-958886.1.patch

Now does mobile, and a try run that should actually run tests.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=f7380155d0f3

Comment 10

[Mike Connor [:mconnor]]

Comment on attachment 8622723 [details] [diff] [review]
bug-958886.1.patch

Review of attachment 8622723 [details] [diff] [review]:
-----------------------------------------------------------------

Sorry this sat for so long, I think I skipped over the bug because of the cancelled request on the other patch.  Super happy to see this ready to land. I'd love to see this uplifted to at least Aurora.

Do they have a timeline on removing the 301?

Comment 11

[Francesco Lodolo [:flod]]

(In reply to Mike Connor [:mconnor] from comment #10)
> Sorry this sat for so long, I think I skipped over the bug because of the
> cancelled request on the other patch.  Super happy to see this ready to
> land. I'd love to see this uplifted to at least Aurora.

I assume it's safe to do this on l10n searches as well?

Comment 12

[Francesco Lodolo [:flod]]

Is there anything blocking this bug from landing?

Comment 13

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b6ebb4cba9e1

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/b6ebb4cba9e1

Comment 15

[Camelia Badau [:cbadau], Desktop QA]

I've tested using Firefox 42 Beta 3 (buildID: 20151001142456): 
 - on Windows 7 64bit, the issue is fixed
 - on Mac OSX 10.9.5, the issue is not fixed: the amazon.com searches don't use HTTPS. 

It is expected?

Comment 16

[Chris Peterson [:cpeterson]]

Looking at the Browser Console (SHIFT+CMD+J on OS X), both the Amazon.com search suggestions [1] and searches [2] use HTTPS for me with Firefox Beta 42.
 
[1] https://completion.amazon.com/search/complete?q=hello&search-alias=aps&mkt=1

[2] https://www.amazon.com/s?ie=UTF8&field-keywords=hello&index=blended&link_code=qs&sourceid=Mozilla-search&tag=mozilla-20

Comment 17

[Camelia Badau [:cbadau], Desktop QA]

Thank you, Chris! It works fine on Mac OSX 10.9.5 using Firefox 42 Beta 4 (buildID: 20151005144425).