Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrading to https not handling a serverside https downgrade #40346

Closed
3 of 5 tasks
cuba opened this issue Aug 7, 2024 · 1 comment · Fixed by brave/brave-core#25027 or brave/brave-core#25302
Closed
3 of 5 tasks
Assignees

Comments

@cuba
Copy link

cuba commented Aug 7, 2024

Description

Sites such as http.badssl.com will downgrade https to http which will cause us try to upgrade multiple times before webkit spits out an error and an exception is added. This is not good because this will cause unnecessary redirects future problems (such as when using chromium web views) which may result in infinite redirect loops.

Steps to reproduce

This is currently not reproducable until after we merge @kylehickinson 's PR: brave/brave-core#24657

However we should do a sanity test on https upgrading anyways. You should make sure to test both http://http.badssl.com which does a https->http redirect and http://example.com which does not.

Actual result

N/A

Expected result

N/A

Reproduces how often

No steps to reproduce

Brave version

1.68

Device/iOS version

Any

Affected browser versions

  • latest AppStore
  • latest TestFlight
  • previous TestFlight

Reproducibility

  • with Brave Shields disabled
  • in the latest version of mobile Safari

Miscellaneous information

No response

@hffvld
Copy link
Contributor

hffvld commented Oct 3, 2024

Verified on iPhone 14 and iPad Mini (6th gen) using version(s):

Device/OS: 
- iPhone 14 / iOS 17.7
- iPad Mni (6th gen) / iPadOS 18
Brave build: 1.70 (123)
BraveCore: 1.70.123 (129.0.6668.89)

STEPS:

  1. Follow the STR/TP from Upgrading to https not handling a serverside https downgrade #40346 (comment)
  2. Verify

ACTUAL RESULTS:

  • Verified that navigating to http://http.badssl.com/ downgrades https redirection to http and doesn't cause infinite redirect loops.
  • Verified that navigating to http://example.com/ redirects to https and doesn't cause infinite redirect loops.
  • Verified above with Upgrade Connections to HTTPS set to Strict, Standard, and Disabled settings.

iPhone 14 / iOS 17.7

1 2 3 4 5
1 2 3 4 5
1 2 3 4 5
1 2 3 4 5

iPad Mni (6th gen) / iPadOS 18

1 2 3 4 5
1 2 3 4 5
1 2 3 4 5
1 2 3 4 5

@hffvld hffvld added QA Pass - iPhone QA Pass - iPad and removed QA/In-Progress Indicates that QA is currently in progress for that particular issue labels Oct 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment