Disable HTTPS upgrade? [LWN.net]

Disable HTTPS upgrade?

Posted Mar 4, 2025 18:25 UTC (Tue) by excors (subscriber, #95769)
In reply to: Disable HTTPS upgrade? by Cyberax
Parent article: Firefox 136.0 released

The page linked in the release notes (https://support.mozilla.org/kb/https-first) says:

> To avoid upgrade attempts users can enter an address in the address bar with an explicit http:// scheme. Permanent exceptions added in the HTTPS-Only Mode section in Firefox settings will also prevent upgrades.

Also there's the dom.security.https_first setting, and various subsettings including https_first_for_local_addresses (default false) and https_first_for_custom_ports (default false).

to post comments

Disable HTTPS upgrade?

Posted Mar 4, 2025 18:31 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link] (4 responses)

My local sites are on IPv6 (yeah, I'm a glutton for punishment) and they are proxied through a host that also has a port 443 open. So Firefox tries to auto-upgrade the connection, and then fails the certificate check.

Just specifying the HTTP manually does nothing, it still tries to upgrade.

Disable HTTPS upgrade?

Posted Mar 5, 2025 8:45 UTC (Wed) by PeeWee (subscriber, #175777) [Link] (3 responses)

Are you sure you don't have HTTPS-Only activated? Because that seems to take precedence over HTTPS-First.

Disable HTTPS upgrade?

Posted Mar 5, 2025 19:06 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

I think what happened is that I entered the address without the "http://" prefix, and it's now stuck. Now even when I try to specify the plain HTTP, Firefox tries to "ugprade" it.

FFS, Firefox developers. When you do BS like this, provide opt-outs.

Disable HTTPS upgrade?

Posted Mar 6, 2025 0:56 UTC (Thu) by PeeWee (subscriber, #175777) [Link]

Instead of shouting at them from here, why don't you report a bug? This is clearly not how this is supposed to work, as per their official documentation. And it sounds like the "Awesome Bar", which is indeed awesome, might be too clever for once, or someone just forgot about it.

Disable HTTPS upgrade?

Posted Mar 6, 2025 1:23 UTC (Thu) by PeeWee (subscriber, #175777) [Link]

I just found an easy fix for this: delete the site from history by telling FF to "Forget About This Site..." in the history sidebar.