Question

I’ve developed a standalone XULRunner app which I’m using as a browser. I’m not displaying the URL in the app. But I’d like to tell if the site accessed is using SSL (i.e., the URL starts with https://). I’d like to display a message to the user if the section of the site they are in is secure or not. And, I guess the way to do it is by inspecting if a URL is using SSL or not. I’ve done some searches but no success so far, but I haven’t given up. Any suggestions will be highly appreciated.

I’ve done some changes, and now my onSecurityChange() method is shown below.

onSecurityChange: function(aWebProgress, aRequest, aState) { 
  if((aState & Components.interfaces.nsIWebProgress.STATE_IS_SECURE) == 0) {
    document.getElementById("lblConnectionStatus").setAttribute("value", "Insecure Connection");
  } else {
    document.getElementById("lblConnectionStatus").setAttribute("value", "Secure Connection");
  } 
  return 0; 

}

However, it doesn’t seem to change when I transition from insecure to secure pages. I’ve tried it with Yahoo and Hotmail, to see whether the problem is with the application I’m accessing, but there, too, it behaves the same.

Any pointer on what I may be doing wrong? Thanks in advance.

Answer 1

It’s a bit more complicated than that – even if the page itself is loaded via SSL it could embed scripts loaded via plain HTTP. That would mean that the entire page is not secure because the insecure script can compromise everything else. So you should rely on existing mechanisms, namely browser.securityUI property (also available on tabbrowser). The answer here explains how one would check the SSL status of a page.

However, you probably want to learn when the SSL status changes. You would use a progress listener for that. The method onSecurityChange() will be called for all relevant changes, you will need to check the aState parameter (the connection is only secure when aState & Components.interfaces.nsIWebProgress.STATE_IS_SECURE gives you a non-zero value).