www.smashingmagazine.com - see bug description

[simevidas]

URL: https://www.smashingmagazine.com/
Browser / Version: Firefox 52.0
Operating System: Windows 10
Problem type: Something else - I'll add details below

Steps to Reproduce

1. Navigate to: https://www.smashingmagazine.com/

Expected Behavior:
The website should load normally, like it does in Chrome and Edge.

Actual Behavior:
Firefox shows a “Corrupted Content Error” error page.

Sorry, I don’t know how to debug this. I initially thought this was affecting me specifically (due to an issue with my PC, plugins, Wi-Fi, anti-virus, etc.), but another user on Twitter reported the same issue, so I assume it affects many (all?) Firefox users.

From webcompat.com with ❤️

[adamopenweb]

Thanks for the report @simevidas. I can't reproduce this in Firefox 52 for OSX.

This issue popped up recently on another site. I'm not sure the cause here, but the error message has to do with a service worker error. See this comment https://bugzilla.mozilla.org/show_bug.cgi?id=1310893#c6.

[simevidas]

Ah, I see. If I understand correctly, Smashing Magazine is using the service worker API incorrectly, and they need to update their code.

🔔 Shame on me for not checking the console.

[karlcow]

Ah interesting I reported a long bug report yesterday about it, but personally because I didn't think it was a Web compatibility issue, but let me share my findings (I should have saved the content of my message written in the form).

This issue is not happening for me in a clean profile, but I can reproduce every time when I use uBlock Origin and uMatrix. I get the same message than @simevidas
When I inspect what is happening with the developer tools, I noticed two things:

1. Console log message

   Failed to load ‘https://www.smashingmagazine.com/’. A ServiceWorker passed a redirected Response to FetchEvent.respondWith() while RedirectMode is not ‘follow’. serviceWorker.js:1242:2

2. HTTP Request headers containing Referer: https://www.smashingmagazine.com/serviceWorker.js

GET / HTTP/1.1
Host: www.smashingmagazine.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en,fr;q=0.7,en-US;q=0.3
Accept-Encoding: gzip, deflate, br
Referer: https://www.smashingmagazine.com/serviceWorker.js
origin: https://www.smashingmagazine.com
DNT: 1
Connection: keep-alive

This specific request header is smelly. I'm not even sure how this is happening.

When I request the source for the service worker with view-source:https://www.smashingmagazine.com/serviceWorker.js

I get

Secure Connection Failed

An error occurred during a connection to www.smashingmagazine.com. The server uses key pinning (HPKP) but no trusted certificate chain could be constructed that matches the pinset. Key pinning violations cannot be overridden. Error code:
MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE

if I try to do a GET on https://www.smashingmagazine.com/serviceWorker.js, I receive the corrupted error content message. With nightly on a clean profile I get the content. The HTTP response is

HTTP/2.0 200 OK
Server: nginx
Date: Mon, 24 Oct 2016 23:45:43 GMT
Content-Type: application/javascript; charset=UTF-8
Last-Modified: Mon, 11 Jul 2016 13:55:15 GMT
Vary: Accept-Encoding
Etag: W/"5783a543-9932"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Pragma: public
Cache-Control: max-age=315360000, public, must-revalidate, proxy-revalidate
Content-Encoding: gzip
X-Firefox-Spdy: h2

[karlcow]

Also there is an issue with the smashing magazine certificate.
https://www.ssllabs.com/ssltest/analyze.html?d=www.smashingmagazine.com&latest

The relevant failing part is:

Chain issues Incorrect order, Contains anchor

DROWN (experimental)    Check failed
(1) For a better understanding of this test, please read this longer explanation
(2) Key usage data kindly provided by the Censys network search engine; original DROWN test here
(3) Censys data is only indicative of possible key and certificate reuse; possibly out-of-date and not complete
ERROR: Connection refused
ERROR: Connection refused

[karlcow]

https://blog.qualys.com/securitylabs/2016/03/04/ssl-labs-drown-test-implementation-details

[karlcow]

At least I know that blocking the referer doesn't change anything about the issue, after setting the sendRefererHeader:

network.http.sendRefererHeader to 0

[karlcow]

Ah and on Safari Preview and Safari stable on desktop
https://www.smashingmagazine.com works
then click on the first article and I get a blank page.

[karlcow]

Hmmm Firefox Nightly too now. Maybe there is another issue.

[miketaylr]

@simevidas

The website should load normally, like it does in Chrome and Edge.

Do you still get this error? Wondering if @smashingmagazine made a quick update or if there's something else to getting this to reproduce.

[simevidas]

😄 The site now loads fine in my Firefoxes. I think, this can be closed.

[adamopenweb]

Thanks!