[FIXED] Links on MSN.COM no longer work

[barbaz]

Oh, do scripts need allowed in order to reproduce the problem? I had scripts blocked the whole time. Does the explicit port go away when scripts are allowed?

[therube]

Yes, actually, at the least for msn.com.

And if you start out with scripts blocked, a linked page, http://www.msn.com/en-us/sports/nba/leb ... li=BBnbfcL does display, but once you allow msn.com, you'll get the message.

[photoray]

Same for me as therube pointed out above.
Happens on Windows 7, 8.1, 10 and also Ubuntu and Mint using Firefox 45.0.0 with NoScript 2.9.0.7

[GWG]

Longtime user and never have had a problem. The MSN.com link problem was driving me crazy. I completely disabled it in the firefox addons and found the problem disappeared. Re-enabled it and MSN links no longer worked. I finally found this forum topic (and joined) that confirmed the latest version was the problem. I downgraded to 29.0.4 cr1 and MSN is working again. (PS I tried the 'f'ix' listed earlier in the thread and didn't work).
I did notice when i reverted to 2.9.0.4 that the lock changed from a red lock with the yellow exclamation back to the gold unlocked graphic and it says www.msn.com instead of https:/....... in the address bar.

[barbaz]

(PS I tried the 'f'ix' listed earlier in the thread and didn't work).

Which 'fix', the NoScript update or the about:config pref change?

[GWG]

(PS I tried the 'f'ix' listed earlier in the thread and didn't work).

Which 'fix', the NoScript update or the about:config pref change?

This one from pg 2

I've just released a tentative fix (i.e., since I cannot reproduce, I can tell for sure) based on comments about explicit ports in links.

[barbaz]

Thank you for clarifying.

I've done some more testing - SeaMonkey 2.42pre (+devtools) / NoScript 2.9.0.8rc1

My Browser Console output (trimmed of most known-irrelevant stuff):

Code: Select all

[NoScript HTTPS] Redirected Channel https://www.msn.com/en-us/sports/ncaabk/villanova-back-in-sweet-16-with-87-68-rout-of-iowa/ar-BBqHQ0P?li=BBnb7Kz
[NoScript HTTPS] AUTOMATIC SECURE on https://www.msn.com: MSPAuth=; domain=.msn.com; path=/; HttpOnly; Secure
[NoScript HTTPS] AUTOMATIC SECURE on https://www.msn.com: MSPProf=; domain=.msn.com; path=/; HttpOnly; Secure
NetworkHelper.getReasonsForWeakness threw an exception: STATE_IS_BROKEN without a known reason. Full state was: 1 DevToolsUtils.js:63:0
static-sports-eus.s-msn.com:443 uses an invalid security certificate.

The certificate is only valid for the following names:
  a248.e.akamai.net, *.akamaihd.net, *.akamaihd-staging.net, *.akamaized.net, *.akamaized-staging.net  

Error code: <a id="errorCode" title="SSL_ERROR_BAD_CERT_DOMAIN">SSL_ERROR_BAD_CERT_DOMAIN</a>
 <unknown>
NetworkError: A network error occurred. <unknown>

(Error Console shows nothing additional informative, but the ordering of the messages in the Error Console helped some with figuring out which messages relate to what. I think I like this dual-console system.)


Neither removing the :80 nor changing the link itself to https made a difference.

At this point I'm thinking that MSN simply doesn't support HTTPS, and the "fix" for this specific case is for Giorgio to add as default to disable forcing HTTPS on msn

[oldgeek52]

I just tried vers. 2.9.0.8rc1 and it did not fix the problem of MSN links not opening. Unfortunately, every time I start FF, it downloads the latest version of NoScript - I can't lock NoScript into a prior version that works with MSN.

[barbaz]

You actually can prevent Fx automatically updating NoScript, but downgrading NoScript is not necessary. I'm thinking, this (or something to this effect) is the actual solution here:

I suggest to add .msn.com to your NoScript Options|Advanced|HTTPS|Never force... box.

[Giorgio Maone]

I start to believe I cannot reproduce it because of some geographical reasons.
When I open https://www.msn.com I get no Surrogate ScriptL warnings, and the certificate actually seems to be valid.

The log posted by barbaz a couple messages ago suggests that the wrong certificate (an Akamai one) gets served for him. However it seems he's also using the automatic secure cookie upgrade feature?

Anyway, I guess the "correct" solution at this point is removing msn.com from the default whitelist in next release.

[barbaz]

Wait a sec, am I misunderstanding this changelog item?

Code: Select all

v 2.9.0.6
=============================================================
x [HTTPS] Limit httpsDefWhitelist effect to document loads

It's definitely not the document domain in the console message. Is the sub-URI being force-HTTPSed by NoScript, or is its HTTPSing just a consequence of how the site is designed?

Off to test this...

[oldgeek52]

I added msn com. to the Options/Advanced/HTTPS/Behavior to the never force box and restarted FF. It did not fix problem.

[barbaz]

That fixes it here...

Wait a sec, am I misunderstanding this changelog item?

Nope, apparently not. Even first-party subresources are not force-HTTPSed even when the top-level document is.


I should also note that httpsDefWhitelist will ONLY force HTTPS on a default-whitelisted site that is actually whitelisted. That explains the behavior I got earlier, and why scripts allowed is needed to reproduce the problem.

[Giorgio Maone]

I added msn com. to the Options/Advanced/HTTPS/Behavior to the never force box and restarted FF. It did not fix problem.

You should add .msn.com (notice the leading ".").
Alternatively, since I'm unable to reproduce this issue, I'd appreciate you to rather remove msn.com from the noscript.default about:config preference and restart the browser, instead.

[Tsami]

Today's release of 2.9.0.9rc1 seems to have fixed the msn.com problem - glad for that, and thanks!

There is another seemingly related problem that occurs with the DVD section of Netflix at https://dvd.netflix.com. When I input the first few letters of a DVD search and press Enter without choosing from the drop-down list of titles, I get a page saying, "The page isn't redirecting properly - Firefox has detected that the server is redirecting the request for this address in a way that will never complete." If I select one of the listed titles, the new page displays correctly.

Just as with the msn.com, this began with Version 2.9.0.5rc1, but has continued through 2.9.0.9rc1. And, just as with msn.com, if I disable NoScript, the Netflix DVD site works correctly by displaying a list of titles that most closely resemble the search string that I enter. No problems with Version 2.9.0.4 either.