Bug 1904238 - Don't copy over https-first and -only flags on http redirects r=maltejur

To not unexpectedly downgrade requests that weren't upgraded via HTTPS-First.

From the added tests only the http redirect test cases start passing
with this patch. META and JS redirect already pass before this patch.

Differential Revision: https://phabricator.services.mozilla.com/D215214
This commit is contained in:
Manuel Bucher
2024-08-27 13:48:32 +00:00
parent 44cdf1e833
commit e0d109208b
5 changed files with 247 additions and 0 deletions

View File

@@ -4437,6 +4437,11 @@ already_AddRefed<nsILoadInfo> HttpBaseChannel::CloneLoadInfoForRedirect(
newLoadInfo->SetLoadTriggeredFromExternal(false);
}
newLoadInfo->ResetSandboxedNullPrincipalID();
// Reset HTTPS-first and -only status on http redirect. To not unexpectedly
// downgrade requests that weren't upgraded via HTTPS-First (Bug 1904238).
Unused << newLoadInfo->SetHttpsOnlyStatus(
nsILoadInfo::HTTPS_ONLY_UNINITIALIZED);
}
newLoadInfo->AppendRedirectHistoryEntry(this, isInternalRedirect);