X
Tap here to go to the mobile version of the site.

Support Forum

FF 22 is forcing YouTube to be HTTPS. Why?

Posted

Why is Firefox 22 forcing YouTube pages to be HTTPS rather than HTTP? I have them bookmarked as HTTP, yet they are now showing up as HTTPS. With this new setup, the preview images for other videos on a video page are not showing up. Safari and Opera browsers are still accessing YouTube as HTTP, so it cannot be the site doing that switch. Is there some way to stop this?

Why is Firefox 22 forcing YouTube pages to be HTTPS rather than HTTP? I have them bookmarked as HTTP, yet they are now showing up as HTTPS. With this new setup, the preview images for other videos on a video page are not showing up. Safari and Opera browsers are still accessing YouTube as HTTP, so it cannot be the site doing that switch. Is there some way to stop this?

Additional System Details

Installed Plug-ins

  • The QuickTime Plugin allows you to view a wide variety of multimedia content in web pages. For more information, visit the QuickTime Web site.
  • Shockwave Flash 11.7 r700
  • Displays Java applet content, or a placeholder if Java is not installed.
  • 5.1.20125.0
  • The Flip4Mac WMV Plugin allows you to view Windows Media content using QuickTime.
  • iPhoto6
  • RealPlayer Plugin

Application

  • User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:22.0) Gecko/20100101 Firefox/22.0

More Information

jscher2000
  • Top 10 Contributor
8200 solutions 67063 answers

Helpful Reply

It seems odd for Firefox to override a bookmark. When I visit using a history link, I'm not forced to HTTPS.

Does it matter whether you are logged in to your Google account when visiting the page?

It seems odd for Firefox to override a bookmark. When I visit using a history link, I'm not forced to HTTPS. Does it matter whether you are logged in to your Google account when visiting the page?
cor-el
  • Top 10 Contributor
  • Moderator
17000 solutions 153506 answers
See also http://blog.sidstamm.com/2010/08/http-strict-transport-security-has.html

Question owner

I do not have a Google account, and I refuse to get one. Google does enough snooping already without that.

I see no point in forcing YouTube to be secure. With search engines, it makes sense, but with a video site - what is the point? With secure YouTube, I get a broken-security symbol in my address bar, which usually indicates mixed content. Since the security is not perfect anyway, why force that?

The other 2 browsers that I have do not force YouTube to be HTTPS, and Opera is more picky about what is secure than Firefox is.

I read another article about strict transport security, and it seemed to indicate that there is a list of what sites will be forced to be secure. Where does Firefox put that list, and how do I modify it to remove youtube.com from it? Why does YouTube being secure block the preview images from the video list on a video page?

I do not have a Google account, and I refuse to get one. Google does enough snooping already without that. I see no point in forcing YouTube to be secure. With search engines, it makes sense, but with a video site - what is the point? With secure YouTube, I get a broken-security symbol in my address bar, which usually indicates mixed content. Since the security is not perfect anyway, why force that? The other 2 browsers that I have do not force YouTube to be HTTPS, and Opera is more picky about what is secure than Firefox is. I read another article about strict transport security, and it seemed to indicate that there is a list of what sites will be forced to be secure. Where does Firefox put that list, and how do I modify it to remove youtube.com from it? Why does YouTube being secure block the preview images from the video list on a video page?

Question owner

I did some more testing and found that it was the extension Disconnect forcing YouTube to HTTPS. Disabling it did not stop the preview images from being blocked, however. What is preventing the preview images from loading?

I did some more testing and found that it was the extension Disconnect forcing YouTube to HTTPS. Disabling it did not stop the preview images from being blocked, however. What is preventing the preview images from loading?
jscher2000
  • Top 10 Contributor
8200 solutions 67063 answers

You can view the current site-specific STS settings using the SQLite Manager extension.

https://addons.mozilla.org/en-US/firefox/addon/sqlite-manager/

From the toolbar, open permissions.sqlite, then you can search for Youtube permissions using the Browse & Search tab, search button, as shown in the attached screen shot.

If you're curious about ALL strict transport permissions that have been set, you can paste this into the Execute SQL tab and run it:

SELECT * FROM moz_hosts WHERE type LIKE 'sts%' ORDER BY type, host

Do you use NoScript? There seems to be a feature to prevent sites from using HTTPS under Options > Advanced > HTTPS, but I don't know whether it actually can override Firefox's native behavior.

You can view the current site-specific STS settings using the SQLite Manager extension. https://addons.mozilla.org/en-US/firefox/addon/sqlite-manager/ From the toolbar, open permissions.sqlite, then you can search for Youtube permissions using the Browse & Search tab, search button, as shown in the attached screen shot. If you're curious about ALL strict transport permissions that have been set, you can paste this into the Execute SQL tab and run it: SELECT * FROM moz_hosts WHERE type LIKE 'sts%' ORDER BY type, host ---- Do you use NoScript? There seems to be a feature to prevent sites from using HTTPS under Options > Advanced > HTTPS, but I don't know whether it actually can override Firefox's native behavior.
jscher2000
  • Top 10 Contributor
8200 solutions 67063 answers

Can you provide a URL for a page where preview images are not loading?

Can you provide a URL for a page where preview images are not loading?

Question owner

Those are two pages (out of many) where the preview thumbnail pics are blocked. I do not use NoScript. I am thinking now that forcing HTTPS had nothing to do with blocking the images. Both started at the same time, which is why I thought they were connected.

* http://www.youtube.com/watch?v=YQ5n9ZrYuHs&feature=related * http://www.youtube.com/watch?v=XITHbsUUlYI Those are two pages (out of many) where the preview thumbnail pics are blocked. I do not use NoScript. I am thinking now that forcing HTTPS had nothing to do with blocking the images. Both started at the same time, which is why I thought they were connected.
jscher2000
  • Top 10 Contributor
8200 solutions 67063 answers

The images on the right column? They seem to take a long time to load using either HTTP or HTTPS, but for me they load either way. I didn't dig under the covers to see how that works but clearly it is an AJAX request that runs after the main page load.

The images on the right column? They seem to take a long time to load using either HTTP or HTTPS, but for me they load either way. I didn't dig under the covers to see how that works but clearly it is an AJAX request that runs after the main page load.

Question owner

I tried making a new profile and it did not help, so I give up. I guess I can get along without thumbnail images if I have to. I am still wondering why ytimg changed the URLs for the images for Firefox but not other browsers.

I tried making a new profile and it did not help, so I give up. I guess I can get along without thumbnail images if I have to. I am still wondering why ytimg changed the URLs for the images for Firefox but not other browsers.
MozillaBurger 0 solutions 4 answers

Helpful Reply

This is a problem that was reported to the Firefox programmers nearly a year ago, and they've spent the last year chit chatting about it and not fixing it.

https://support.mozilla.org/en-US/questions/933470

It forces HTTPS on pretty much every web site once it goes to HTTPS.  This issue forced me to bail on Firefox completely because I could not manage my websites while always viewing them through HTTPS.
This is a problem that was reported to the Firefox programmers nearly a year ago, and they've spent the last year chit chatting about it and not fixing it. https://support.mozilla.org/en-US/questions/933470 It forces HTTPS on pretty much every web site once it goes to HTTPS. This issue forced me to bail on Firefox completely because I could not manage my websites while always viewing them through HTTPS.

Question owner

I found out the answer to both questions by experimenting with the profile. The extension Disconnect was causing YouTube to be HTTPS. A capability policy I had tried to set up to prevent onunload from causing popup windows was blocking the thumbnails somehow. They had nothing to do with each other. I am back to using Disconnect, and YouTube is still HTTPS with no problems.

I found out the answer to both questions by experimenting with the profile. The extension Disconnect was causing YouTube to be HTTPS. A capability policy I had tried to set up to prevent onunload from causing popup windows was blocking the thumbnails somehow. They had nothing to do with each other. I am back to using Disconnect, and YouTube is still HTTPS with no problems.
jscher2000
  • Top 10 Contributor
8200 solutions 67063 answers

Hi MozillaBurger, this thread is about a different issue not related to URLBar AutoFill.

Hi MozillaBurger, this thread is about a different issue not related to URLBar AutoFill.