[BUG] HSTS with Redirection is broken in WebKit on Linux

[justasz505hq]

Hello!
I'm currently seeing an issue with webkit when being ran on ubuntu CI machines.
Button clicks with navigations and page loads result in http instead of https protocol.
This behavior can only be observed with mentioned combination and not with any other - firefox, chrome and edge on ubuntu are fine.
Using Playwright 1.51, Python3.12, Ubuntu 24.04, Webkit 18.4.

Notice in the trace how button clicks redirects to http (should always be https) or simply reloads the page with http instead of correct navigation
webkit_ubuntu_trace

[mxschmitt]

According to the trace

https://signspace.dev-vastuugroup.fi/signing/en/67dad84151e01f037f77c575/test_user_1742395459.167469@m2cvy3aw.mailosaur.net/sign

is redirecting to http from https://

So it looks like the web page is deciding to redirect from https:// back to http:// - maybe a bug in the backend?

Edit: Looks like your site sets strict-transport-security so the browser should stay on https:// while WebKit on Linux might not do it, let me see if I can create a minimal reproduction for it.

Have you tried running your test on Safari and does it pass there?

Would it be possible to provide the same trace for Chromium?

[justasz505hq]

@mxschmitt thank you for quick response!

Here's how it looks like Chromium on Ubuntu. All redirects are https protocol and no unexpected page reloads
chromium_ubuntu_trace

Have you tried running your test on Safari and does it pass there?

I may not be aware how to do it with branded Safari and playwright, unless that's not what you're asking.

For reference this is how it looks like when the test is ran locally (Webkit on Mac), same behavior - no unexpected results.
webkit_macos_trace

Let me know if there's anything else I can provide

[mxschmitt]

Thanks, that was helpful. I'm pretty sure its related to HSTS. When I execute the following test (deployed on the web) then its passing for on macOS on all the browsers and on Linux on Firefox and Chromium but not in WebKit:

it('should stay on https:// if the backend is using strict-transport-security', async ({ browser, httpsServer }) => {
  const context = await browser.newContext({ ignoreHTTPSErrors: true });
  const page = await context.newPage();
  await page.goto('https://<the-site>/');
  await page.goto('https://<the-site>/redirect-to-http');
  await expect(page).toHaveURL('https://<the-site>/');
});

// @ts-check
// Requires:
// - openssl req -x509 -newkey rsa:2048 -nodes -keyout private-key.pem -out certificate.pem -days 365 -subj "/CN=localhost"
import https from 'node:https'
import http from 'node:http'
import fs from 'node:fs'

const httpServer = http.createServer((req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/plain' })
  res.end('Hello World\n')
});

const httpsServer = https.createServer({
  key: await fs.promises.readFile('private-key.pem'),
  cert: await fs.promises.readFile('certificate.pem')
}, (req, res) => {
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload')
  if (req.url === '/redirect-to-http') {
    res.writeHead(302, { Location: `http://${req.headers.host}` })
    res.end()
    return
  }
  res.writeHead(200, { 'Content-Type': 'text/html' })
  res.end('<p>Hello Secure World</p>')
});

await new Promise((resolve) => {
  httpServer.listen(80, '0.0.0.0', () => {
    console.log('HTTP Server running at http://localhost')
    resolve(null)
  })
});

await new Promise((resolve) => {
  httpsServer.listen(443, '0.0.0.0', () => {
    console.log('HTTP Server running at https://localhost')
    resolve(null)
  })
});

No further action needed from your side, thanks!

[mxschmitt]

Looks like reverting WebKit/WebKit#12566 makes it pass.

Filed upstream in https://bugs.webkit.org/show_bug.cgi?id=290204.

[mxschmitt]

Should be fixed in Canary in 12-24 hours: https://playwright.dev/docs/canary-releases after #35716 has been landed and released.