{"issue":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"milestone":null,"created_at":"2011-12-22T05:28:56Z","title":"Requests from about:home blocked in Firefox 4","updated_at":"2011-12-22T05:28:58Z","labels":[{"name":"extension","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/labels/extension","color":"ededed"}],"state":"open","id":2633944,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"html_url":"https://github.com/RequestPolicy/requestpolicy/issues/140","closed_at":null,"number":140,"body":"Going to about:home in Fx4 allows the page to load but requests from the page are considered to originate from about:home rather than the URL that about:home actually caused to be loaded. This means that, for example, the default google search page's search box doesn't work.\r\n\r\nTrying on Fx 3.6, going to about:home seems to result in the location bar changing to the real location. That has the side effect of allowing !RequestPolicy to work nicely with about:home.\r\n\r\nI see this in the !NoScript changelog:\r\n\r\n{{{\r\nv 1.9.9.73\r\n==========================================================================\r\n...\r\n+ Added about:addons and about:home to the mandatory whitelist\r\n...\r\n}}}\r\n\r\nWhitelisting about:home seems a little sketchy.\r\n\r\nMaybe one solution is to try to redirect users from about:home to the actual location.\r\n\r\nfwiw, if Fx 4 keeps this behavior then a few kids will run around entertaining themselves by switching people's home page to their own phishing page and the 1% of users who would have normally noticed the odd location in the location bar will no longer be able to notice.","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/issues/140","comments":1,"assignee":null},"comment":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"created_at":"2011-12-22T05:28:58Z","updated_at":"2011-12-22T05:28:58Z","id":3245151,"body":"[justin] Fixed in r384. The simple solution wins: allow all requests from about:home. I don't really like this solution, but as the content of about:home uses locally stored content (https://bugzilla.mozilla.org/show_bug.cgi?id=563723) and so isn't just hiding a true URL we can translate it into, then there doesn't seem to be a lot of options other than letting the user find out the hard way or just making it work. Making this issue less bad than I previously thought is the fact that about:home is not an alias for whatever default home page the user has set. Instead, it's essentially a local application.\r\n\r\nSomeday it would be nice to add an advanced preference where users could disable the \"compatibility rules\" and any other compromises we've made for usability reasons.","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/issues/comments/3245151"},"action":"created"}