Noscript 5.1.8.3 force https on every single page

[Moreno]

Hello! I am writing in English but I am Italian, if my English is too mangled to explain the problem I can explain it again in italian.

I am still using Firefox 56 and NoScript 5.1.8.3
I am using Linux Mint 18.2 Sonya, and the version of Firefox 56 that I am using is the one in the Linux Mint depository, that is lightly different from the standard one and has a few add-on already installed. Apart from these, Noscript is the ONLY add-on I have installed.

I upgraded to 5.1.8.3 a few days ago, but from that time I had not rebooted the computer or closed Firefox. I did upgrade some other linux sofware, but nothing related to this problem I think. I COULD maybe have changed some NoScript setting, but not voluntarily and I did not notice it (meaning: I often go to the noscript menu to temporarily allow some site or script, and it's possible that I clicked on the wrong place by mistake, but I did not voluntarily change any setting that I know of) Then yesterday I had a power shortage and my PC shut down.

I rebooted the PC, everything seemed OK... but after a while I noticed that SOME web pages were giving me problems (errors 404, blank pages, etc.) For example, on ebay.it I could not add or change memos or see the different bids on an auction or see the "bacheca annunci" (all the rest I tried worked). Then, a couple of forums I frequent did not open and I received various security warning FROM FIREFOX (not Noscript) about missing security certifieds.

After a while I realized the problem: EVERY SINGLE PAGE, TABS OR FORM had the "Https" at the beginning of the url, even the ones that up to that day didn't. When the site was old like the two forums, it could not offer a certificate and firefox generated an error. When instead the site, like ebay, had mixed content, the content that could not form a secure connection simply didn't appear.

I looked at the Firefox help pages all day to fix this, because I assumed that it was the browser's fault (as I said I don't recall changing anything on NoScript apart from temporary permissions) to no avail. But trying with other sites I noticed that SOME sites still worked, if scripts were totally blocked. And ceased to work if I temporarily did allow some script.

So I tried adding the domains of the sites that were giving me problems to the "never force secure connections for the following sites" list on "Options-Advanced-HTTPS"... (up to that moment both the lists on that tab were empty) and they began to work again.

It's a solution? No, because I can't continue to add every single site I visit to that list. For example, to be able to use ebay I had to check the source code of every single page that gave me problems, find the links, and add "www2.ebay.com", "my.ebay.it" and "offer.ebay.it" to the list, it took a lot of time and I am still not sure I did not miss a link. I can't do it for every http or mixed page I visit!

Someone had the same problem? How can I solve it and make NoScript works as before?

[barbaz]

Try going to about:config and setting noscript.httpsDefWhitelist to false

[Moreno]

Done (it was set to "true"). Now I will check if the problem is still there or not

I am writing now before checking because I am seeing another item on the list that could be the problem (it's bold, so it was changed from the default value)
"noscript allow Https Only" is set at 1 (I had to separate the words because something was triggering the antispam)
I did not change it for now, I wanted to ask here in the forum before making other changes

[barbaz]

I am seeing another item on the list that could be the problem (it's bold, so it was changed from the default value)
"noscript allow Https Only" is set at 1 (I had to separate the words because something was triggering the antispam)
I did not change it for now, I wanted to ask here in the forum before making other changes

Yes, try resetting that pref as well (default value should be 0)

[Moreno]

Hi! I have checked after making the first change (and after removing one by one the sites I had added to the "never force https" list, and checking if they still worked) and after that change everything did seem to work OK, thanks!

I did change the second value (the "allow http only") after that, and everything still did seems to work OK.

The problem (at least for now) seems resolved, thank you!

What do these pref do, and what do you think provoked the problem?

[barbaz]

noscript.httpsDefWhitelist forces HTTPS on every default-whitelisted site. However, in your case it is reaching beyond the default whitelist. First thing to check, do you have a user-set value for about:config > noscript.default ?

noscript.allowHttpsOnly is the pref behind NoScript Options > Advanced > HTTPS > Permissions, "Forbid active web content unless it comes from a secure (HTTPS) connection:". Sometimes NoScript incorrectly detects that people are on a proxy, so unless you KNOW you need this, best keep it set at "Never".

[Moreno]

I checked, but I could not find "noscript (point) default" in the config page.

[barbaz]

I checked, but I could not find "noscript (point) default" in the config page.

???
So you're saying that if you type noscript.default in the search box in about:config, you get nothing listed, despite having NoScript installed?

[Moreno]

I checked, but I could not find "noscript (point) default" in the config page.

???
So you're saying that if you type noscript.default in the search box in about:config, you get nothing listed, despite having NoScript installed?

Yes. (Maybe it's because I have still version 5.1.8.3?)

[barbaz]

That is not right. Please try completely uninstalling NoScript, restarting Firefox, then re-installing NoScript 5.1.8.3 from https://noscript.net/getit

[Moreno]

I have hundreds of open tabs on Firefox (separated into 6 windows), restarting Firefox without NoScript would not accept scripts on every one of them?

[barbaz]

Not sure. I think it depends whether you have Firefox set to load tabs on demand or not.

[Moreno]

Not sure. I think it depends whether you have Firefox set to load tabs on demand or not.

How can I check it? In the "preferences" page I have "shows your windows and tabs from last time"

[Moreno]

Today, I rebooted the PC (I had already done it a lot of times from my last reply), and my browser opened the page that usually appear when it gets a new version of Noscript. The page said that I had 10.1.6.2
I was worried that it had installed the wrong version of NS (I am still on Firefox 56) but no, I still have Noscript 5.1.8.3

Then, just to check, I did look in about:config, and this time, there was a noscript.default value (it was not in bold letters, so it's the default one, I think).

I had checked after rebooting for a few days after my last post, so I don't think that it was only that...