diff --git a/dom/security/nsHTTPSOnlyUtils.cpp b/dom/security/nsHTTPSOnlyUtils.cpp index e354399f399f..43226b2d80b5 100644 --- a/dom/security/nsHTTPSOnlyUtils.cpp +++ b/dom/security/nsHTTPSOnlyUtils.cpp @@ -324,7 +324,9 @@ bool nsHTTPSOnlyUtils::IsUpgradeDowngradeEndlessLoop( // then we are dealing with an upgrade downgrade scenario and we have to break // the cycle. nsCOMPtr triggeringPrincipal = aLoadInfo->TriggeringPrincipal(); - if (!triggeringPrincipal->SchemeIs("https")) { + // Since https-first also accepts http sites, endless loops can also be + // triggered by http sites + if (!triggeringPrincipal->SchemeIs("https") && !enforceForHTTPSFirstMode) { return false; } diff --git a/dom/security/test/https-first/file_endless_loop_http_redirection.sjs b/dom/security/test/https-first/file_endless_loop_http_redirection.sjs new file mode 100644 index 000000000000..9e93c4868a7e --- /dev/null +++ b/dom/security/test/https-first/file_endless_loop_http_redirection.sjs @@ -0,0 +1,40 @@ +const RELAOD_HTTP = ` + + + HTTPS not supported - Bureau of Meteorology + + +`; +const RESPONSE_SUCCESS = ` + + + send message, downgraded + + + `; + +const REDIRECT_307 = + "http://example.com/tests/dom/security/test/https-first/file_endless_loop_http_redirection.sjs?start"; + +function handleRequest(request, response) { + // avoid confusing cache behaviors + response.setHeader("Cache-Control", "no-cache", false); + // Every https request gets redirected + if (request.scheme === "https") { + response.setStatusLine("1.1", 307, "Temporary Redirect"); + response.setHeader("Location", REDIRECT_307, true); + return; + } + // If a 307 redirection took place redirect to same site without query + if (request.queryString === "start") { + response.write(RELAOD_HTTP); + return; + } + // we should get here + response.write(RESPONSE_SUCCESS); +} diff --git a/dom/security/test/https-first/mochitest.ini b/dom/security/test/https-first/mochitest.ini index 492c0e33bcab..e30b27bef302 100644 --- a/dom/security/test/https-first/mochitest.ini +++ b/dom/security/test/https-first/mochitest.ini @@ -39,3 +39,5 @@ support-files = file_bad_cert.sjs [test_downgrade_request_upgrade_request.html] support-files= file_downgrade_request_upgrade_request.sjs +[test_endless_loop_http_redirection.html] +support-files= file_endless_loop_http_redirection.sjs diff --git a/dom/security/test/https-first/test_endless_loop_http_redirection.html b/dom/security/test/https-first/test_endless_loop_http_redirection.html new file mode 100644 index 000000000000..84e095b86c3f --- /dev/null +++ b/dom/security/test/https-first/test_endless_loop_http_redirection.html @@ -0,0 +1,54 @@ + + + + Bug 1725646: HTTPS-First endless loop with http redirection + + + + + + + +