search

ilGur1132 / smart-https

Smart HTTPS
https://mybrowseraddon.com/smart-https.html
Mozilla Public License 2.0
81 stars 16 forks source link

don't whitelist on HTTP 4xx/5xx errors #9

Open snarfed opened 7 years ago

snarfed commented 7 years ago

If an HTTPS URL returns a 4XX or 5XX error, e.g. 404 Not Found error, its domain is added to the whitelist, but it probably shouldn't be. 4XX and 5XX responses mean the server handled the SSL request successfully, and failed for a different reason. Domains should probably only be whitelisted for network/connection failures, not HTTP error responses.

to reproduce:

  1. Fetch https://asdf.com/foo . It returns HTTP 404 Not Found.
  2. Note that asdf.com has been whitelisted.

i'm using Smart HTTPS 0.2.0 with Firefox 54 on Mac OS X 10.11.6.

afontenot commented 7 years ago

I'm not sure, but I think connections that get blocked by uBlock or uMatrix also get detected as connection failures, and added to the whitelist. So I have a bunch of obviously https sites in my whitelist, like Google, Facebook, etc.

EC-O-DE commented 7 years ago

See other open issues. FF dev is at FF/MDN site I think.