Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #234166 > unrolled thread

Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections

Started byCelejar <celejar@gmail.com>
First post2021-04-14 18:20 +0200
Last post2021-04-16 13:30 +0200
Articles 7 on this page of 27 — 15 participants

Back to article view | Back to linux.debian.user

Contents

  Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-14 18:20 +0200
    Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections riveravaldez <riveravaldezmail@gmail.com> - 2021-04-14 21:10 +0200
      Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Nito <nito@dismail.de> - 2021-04-15 02:40 +0200
      Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 04:30 +0200
    Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 00:00 +0200
      Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 04:20 +0200
        Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Kenneth Parker <sea7kenp@gmail.com> - 2021-04-15 05:00 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2021-04-15 06:00 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Kenneth Parker <sea7kenp@gmail.com> - 2021-04-15 07:20 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Dan Ritter <dsr@randomstring.org> - 2021-04-15 15:40 +0200
                Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Kenneth Parker <sea7kenp@gmail.com> - 2021-04-15 16:40 +0200
                Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Richard Hector <richard@walnut.gen.nz> - 2021-04-16 03:10 +0200
                  Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Tixy <tixy@yxit.co.uk> - 2021-04-16 10:40 +0200
                Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-16 12:40 +0200
        Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 12:20 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Darac Marjal <mailinglist@darac.org.uk> - 2021-04-15 12:50 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-15 14:40 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-15 14:40 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Greg Wooledge <greg@wooledge.org> - 2021-04-15 13:30 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 14:20 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2021-04-15 14:40 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 17:20 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections mett <mett@pmars.jp> - 2021-04-15 14:50 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 16:20 +0200
                Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Erwan David <erwan@rail.eu.org> - 2021-04-15 16:50 +0200
                  Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 17:50 +0200
                    Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-16 13:30 +0200

Page 2 of 2 — ← Prev page 1 [2]

#234197

FromEduardo M KALINOWSKI <eduardo@kalinowski.com.br>
Date2021-04-15 14:40 +0200
Message-ID<C49rQ-1tk-15@gated-at.bofh.it>
In reply to#234193
On 15/04/2021 09:12, Celejar wrote:
> On Thu, 15 Apr 2021 11:16:59 +0100
> piorunz <piorunz@gmx.com> wrote:
>
>> On 15/04/2021 03:15, Celejar wrote:
>>
>>> http://www.daat.ac.il/
>>> https://www.daat.ac.il/
>>>
>>> Celejar

I can confirm the problem, by the way.

>> Their webserver is misconfigured. AFAIR, if they don't support https,
>> their server should redirect to http page. Instead, they throw 404 error.
> Do you have a reference for this as required by the standards?

I don't think this is required by any standard.

But it's certainly bad practice: if they don't want to support https, 
they should disable it, and not return a 404 error. It may not be a 
requirement that the http and https content have to be the same, but it 
certainly makes a lot of sense that they are.

So I'd agree that the website is misconfigured. You might try contacting 
them.

Unlike the HTTPS Everywhere extension, that has a list of sites that 
should be accessed only with https, the built-in Firefox function seems 
to just try to make an https connection, and if it succeeds, assumes 
(reasonably, IMHO) that the site supports https. Since 404 is a valid 
response that in no way indicates lack of https support (on the 
contrary), it then redirects everything to https.

The docs say you can disable https for a specific site: 
https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ 
. But if this happens a lot, it might be simpler to simply disable that 

Firefox feature. Not because it's buggy, but because it make reasonable 
assumptions about websites' behaviours, which unfortunately are not 
followed by everyone.



-- 
Canada Bill Jones's Motto:
	It's morally wrong to allow suckers to keep their money.

Canada Bill Jones's Supplement:
	A Smith and Wesson beats four aces.

Eduardo M KALINOWSKI
eduardo@kalinowski.com.br

[toc] | [prev] | [next] | [standalone]

#234205

FromCelejar <celejar@gmail.com>
Date2021-04-15 17:20 +0200
Message-ID<C4bWG-331-9@gated-at.bofh.it>
In reply to#234197
On Thu, 15 Apr 2021 09:31:11 -0300
Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> wrote:

> 
> On 15/04/2021 09:12, Celejar wrote:
> > On Thu, 15 Apr 2021 11:16:59 +0100
> > piorunz <piorunz@gmx.com> wrote:
> >
> >> On 15/04/2021 03:15, Celejar wrote:
> >>
> >>> http://www.daat.ac.il/
> >>> https://www.daat.ac.il/
> >>>
> >>> Celejar
> 
> I can confirm the problem, by the way.
> 
> >> Their webserver is misconfigured. AFAIR, if they don't support https,
> >> their server should redirect to http page. Instead, they throw 404 error.
> > Do you have a reference for this as required by the standards?
> 
> I don't think this is required by any standard.
> 
> But it's certainly bad practice: if they don't want to support https, 
> they should disable it, and not return a 404 error. It may not be a 
> requirement that the http and https content have to be the same, but it 
> certainly makes a lot of sense that they are.
> 
> So I'd agree that the website is misconfigured. You might try contacting 
> them.
> 
> Unlike the HTTPS Everywhere extension, that has a list of sites that 
> should be accessed only with https, the built-in Firefox function seems 
> to just try to make an https connection, and if it succeeds, assumes 
> (reasonably, IMHO) that the site supports https. Since 404 is a valid 
> response that in no way indicates lack of https support (on the 
> contrary), it then redirects everything to https.

Thank you. That was my analysis of the problem as well.

> The docs say you can disable https for a specific site: 
> https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ 

I tried the setting, but it didn't seem to work.

> . But if this happens a lot, it might be simpler to simply disable that 
> 
> Firefox feature. Not because it's buggy, but because it make reasonable 
> assumptions about websites' behaviours, which unfortunately are not 
> followed by everyone.

I may have to do that.

Celejar

[toc] | [prev] | [next] | [standalone]

#234198

Frommett <mett@pmars.jp>
Date2021-04-15 14:50 +0200
Message-ID<C49Bv-1wC-1@gated-at.bofh.it>
In reply to#234193
2021-04-15 21:12 に Celejar さんは書きました:
> On Thu, 15 Apr 2021 11:16:59 +0100
> piorunz <piorunz@gmx.com> wrote:
> 
>> On 15/04/2021 03:15, Celejar wrote:
>> 
>> >> It certainly works fine for me. I use https only mode for many months
>> >> now. Can you bring an example of a page which returns good page on http,
>> >> but 404 error on https?
>> >
>> > http://www.daat.ac.il/
>> > https://www.daat.ac.il/
>> >
>> > Celejar
>> 
>> Their webserver is misconfigured. AFAIR, if they don't support https,
>> their server should redirect to http page. Instead, they throw 404 
>> error.
> 
> Do you have a reference for this as required by the standards?
> 
>> Your web browser behaviour is as intended, everything is fine.
>> If webadmins of that page don't know their sh*t, are you sure you want
>> to use that website? Who knows what else they forgot to implement.
> 
> No, everything is not fine. The website in question is a very valuable
> one - it contains a wealth of important academic articles that are
> valuable to my work. The techie attitude that the value of a resource
> is somehow correlated to the technical competence of its implementation
> is unfortunate and misguided.
> 
> I might indeed be reluctant to trust such a site with sensitive
> personal information, but to suggest that we should shun websites just
> because their administrators should be doing a better job is illogical.
> 
>> Disclaimer: I never worked in IT, all self taught, but I have webpage
>> which I put up myself on Debian computer, with https cert (it's free),
>> TLS 2.0/3.0 only, PFS, HSTS preload with long duration, OCSP stapling,
>> top spec security. These guys? They can't even redirect to their http 
>> page.
> 
> Celejar

Hi,

The site address you provided support https:
<CN = Sectigo RSA Domain Validation Secure Server CA
  O = Sectigo Limited
  L = Salford
  ST = Greater Manchester
  C = GB>

So, indeed, some misconfiguration it seems.
Maybe they simply forget to redirect http to https.
<Redirect / https://>

Though I agree no need to shun them.

HTH

[toc] | [prev] | [next] | [standalone]

#234202

Frompiorunz <piorunz@gmx.com>
Date2021-04-15 16:20 +0200
Message-ID<C4b0C-2uE-13@gated-at.bofh.it>
In reply to#234198
On 15/04/2021 13:40, mett wrote:

> So, indeed, some misconfiguration it seems.
> Maybe they simply forget to redirect http to https.
> <Redirect / https://>
>
> Though I agree no need to shun them.
>
> HTH

If webadmin FORGETS to implement https in 2021, then he deserves losing
his job. 🤯


--

With kindest regards, piorunz.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#234204

FromErwan David <erwan@rail.eu.org>
Date2021-04-15 16:50 +0200
Message-ID<C4btD-2E4-5@gated-at.bofh.it>
In reply to#234202
Le 15/04/2021 à 16:16, piorunz a écrit :
> On 15/04/2021 13:40, mett wrote:
> 
>> So, indeed, some misconfiguration it seems.
>> Maybe they simply forget to redirect http to https.
>> <Redirect / https://>
>>
>> Though I agree no need to shun them.
>>
>> HTH
> 
> If webadmin FORGETS to implement https in 2021, then he deserves losing
> his job. 🤯
> 
> 

But nothing says that http://<domain> and https://<domain> must have 
same content.

[toc] | [prev] | [next] | [standalone]

#234206

Frompiorunz <piorunz@gmx.com>
Date2021-04-15 17:50 +0200
Message-ID<C4cpI-3cA-7@gated-at.bofh.it>
In reply to#234204
On 15/04/2021 15:49, Erwan David wrote:

>> If webadmin FORGETS to implement https in 2021, then he deserves losing
>> his job. 🤯

> But nothing says that http://<domain> and https://<domain> must have
> same content.

<sarcasm> Of course, 404 error on https version of the website it a
great piece of content. Admins are doing great job.

--

With kindest regards, piorunz.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
⠈⠳⣄⠀⠀⠀⠀

[toc] | [prev] | [next] | [standalone]

#234213

FromJonathan Dowland <jon+debian-user@dow.land>
Date2021-04-16 13:30 +0200
Message-ID<C4uPE-6gO-3@gated-at.bofh.it>
In reply to#234206
On Thu, Apr 15, 2021 at 04:43:12PM +0100, piorunz wrote:
><sarcasm> Of course, 404 error on https version of the website it a
>great piece of content. Admins are doing great job.

On the root page, sure. Who knows if they're actively serving content
on a sub-path.

Anyway, it's easy to throw mud. It doesn't impress anyone. Quite the
opposite.


-- 
Please do not CC me, I am subscribed to the list.

👱🏻	Jonathan Dowland
✎	 jmtd@debian.org
🔗	https://jmtd.net

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web