981307 - FF AJAX does not work with http after https implementing HSTS

Status: RESOLVED DUPLICATE of bug 881830

(Core :: Security, defect)

Description

[Bob Hanson]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20140212131424

Steps to reproduce:

[This is an AJAX-specific problem - I did not see anything on the Component list specific to that. Sorry if I missed it.]

navigate to http://chemapps.stolaf.edu/jmol/testPC.htm

1) click first link top left -- PUG http sync
2) click second link top left -- PUB https sync
3) repeat (1)



Actual results:

1)  We get a nice report after a few seconds with a status OK
2)  same as (1)
3)  Browser blocks access with the following error caught:

[Exception... "Failure" nsresult: "0x80004005 (NS_ERROR_FAILURE)" location: "JS frame :: http://chemapps.stolaf.edu/jmol/testPC.htm :: xhrtest :: line 33" data: no]

(1) will not work again for, oh, about a year, I think.


Expected results:

(3) should have worked same as (1)

Note: We know this is in relation to the site recently implementing HSTS. Their response header includes 

Strict-Transport-Security:"max-age=31536000; includeSubDomains"

That policy works fine usually, but apparently not with the XMLHttpRequest.

Thank you for looking into this.

Bob Hanson
Principal Developer, Jmol

Comment 1

[Boris Zbarsky [:bzbarsky]]

This is bug 881830.  The request is cross-site, so we do CORS checks, and the STS upgrade is treated as a redirect from http://whatever to https://whatever, which fails because the pre-redirect channel hasn't gotten a CORS response (and in fact couldn't have).