Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

shop.countdown.co.nz - Connection is insecure #42674

Closed
webcompat-bot opened this issue Oct 20, 2019 · 3 comments
Closed

shop.countdown.co.nz - Connection is insecure #42674

webcompat-bot opened this issue Oct 20, 2019 · 3 comments
Labels
browser-focus-geckoview engine-gecko The browser uses the Gecko rendering engine priority-normal severity-critical The site or core functionality is unusable, or you would probably open another browser to use it. type-cors Issues with CORS blocking requests differently to other browsers.
Milestone

Comments

@webcompat-bot
Copy link

URL: https://shop.countdown.co.nz/

Browser / Version: Firefox Mobile 69.0
Operating System: Android
Tested Another Browser: Yes

Problem type: Something else
Description: the website says connection is not secure
Steps to Reproduce:

Browser Configuration
  • None

From webcompat.com with ❤️

@webcompat-bot webcompat-bot added this to the needstriage milestone Oct 20, 2019
@webcompat-bot webcompat-bot added browser-focus-geckoview engine-gecko The browser uses the Gecko rendering engine labels Oct 20, 2019
@softvision-oana-arbuzov softvision-oana-arbuzov added priority-normal severity-critical The site or core functionality is unusable, or you would probably open another browser to use it. labels Oct 22, 2019
@softvision-oana-arbuzov softvision-oana-arbuzov changed the title shop.countdown.co.nz - see bug description shop.countdown.co.nz - Connection is insecure Oct 22, 2019
@softvision-oana-arbuzov
Copy link
Member

Thanks for the report, I was able to reproduce the issue.
image

Note:

  1. The issue is also reproducible on Firefox Nightly and Firefox Preview Nightly.
  2. The issue is not reproducible on Chrome.

According to SSL Labs:
image

Tested with:
Browser / Version: Firefox Focus 8.0.23 (🦎 71.0a1-20191018095340), Firefox Nightly 68.2a1 (2019-10-17), Firefox Preview Nightly 191021(🦎: 71.0a1-2019018095340)
Operating System: Huawei P20 Lite (Android 8.0.0) - 1080 x 2280 pixels, 19:9 ratio (~432 ppi density), Samsung Galaxy S7 Edge (Android 8.0.0) - Resolution 1440 x 2560 pixels (~534 ppi pixel density)

Moving to Needsdiagnosis for further investigation.

@wisniewskit
Copy link
Member

I see this in the web console:

10:17:10.588 Loading mixed (insecure) display content “http://cm.g.doubleclick.net/pixel?google_nid=lotame_dmp&google_cm” on a secure page gtm.js:1306:269

And sure enough, in their markup:

<img src="http://cm.g.doubleclick.net/pixel?google_nid=lotame_dmp&amp;google_cm" width="1" height="1">

So there is literally mixed content on the page, making the warning quite apropos. Chrome also gets the mixed content, but does not warn about it (it blocks it outright instead, as per bz1404163).

This isn't really a webcompat issue, so I'll close this as a duplicate of that bug. It's definitely something the site should fix, and of course Firefox ought to also improve its content blocking as per the above bug-comment (but until it does it really is loading mixed content, and should provide this warning as long as users are interested in knowing about mixed content issues).

@wisniewskit wisniewskit self-assigned this Oct 22, 2019
@wisniewskit wisniewskit added the type-cors Issues with CORS blocking requests differently to other browsers. label Oct 22, 2019
@lock
Copy link

lock bot commented Oct 29, 2019

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue at https://webcompat.com/issues/new if you are experiencing a similar problem.

@lock lock bot locked as resolved and limited conversation to collaborators Oct 29, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
browser-focus-geckoview engine-gecko The browser uses the Gecko rendering engine priority-normal severity-critical The site or core functionality is unusable, or you would probably open another browser to use it. type-cors Issues with CORS blocking requests differently to other browsers.
Projects
None yet
Development

No branches or pull requests

3 participants