Jason Duell Reporter
	Description • 15 years ago

This is much like the HTTP auth case:  all we need to do is to figure out how to give the HttpChannelParent the appropriate nsIBadCertListener2 to hand out during GetInterface, and things ought to just work (?)

Without this, test-ipc.xul pops up a "secure connection failed" dialog, which allows the client to see the cert info, but doesn't provide any way to make a cert exception and continue the connection.

I tested this by loading https://mail.yahoo.com/, which on 5/29/10 at least had a bad cert.

Not sure if this depends on bug 536301 or not--Honza?

	Jason Duell Reporter
	Comment 1 • 15 years ago

Honza:  feel free to morph this into a larger "security UI" bug if that's the right way to proceed.

	Honza Bambas (:mayhemer) Assignee
	Comment 2 • 15 years ago

Hmmm... I don't think it is that easy...

By default (when loading an html page) callbacks doesn't provide any badCertListener.  It is not a precondition for the bad cert error page (it lies somewhere else, already discussed in bug 536301 comment 6).

Few components on chrome are pushing nsIBadCertListener2 implementation manually as callbacks to a channel or xmlhttprequest, to suppress the error.  Those seem to be: AddonInstall, UpdateParser, Blocklist.

The first one is using directly an http channel, the last two are using XHR.channel and all set (XHR.)channel.notificationCallbacks = new BadCertListener.  Access to channel's notificationCallbacks is able only on the chrome (or better say, with the chrome privileges).

So, for me, patch for this bug is to let HttpChennelParent throw NO_INTERFACE (not DROP_DEAD!) when nsIBadCertListener2 is demanded.

The rest needed to correctly display the bad cert error page should be part of bug 536301 and the security UI browser binding (bug 568504).

-> me

	Honza Bambas (:mayhemer) Assignee
	Comment 3 • 15 years ago

And also UpdateService's Checker is setting xhr.channel.notificationCallbacks = new BadCertListener.

	Honza Bambas (:mayhemer) Assignee
	Comment 4 • 15 years ago

This makes the bad cert dialog appear w/o any drop_deads.  It is IMO sufficient for the initial merge with m-c, however, working on making the exception page appear in bug 536301 and dependent.

	Honza Bambas (:mayhemer) Assignee
	Comment 5 • 15 years ago

Ups... looks like this patch is completely the same as the already reviewed patch for bug 569098.  Differs just in the comment.

	Jason Duell Reporter
	Comment 6 • 15 years ago

Great minds think alike.