diff --git a/caps/nsPrincipal.cpp b/caps/nsPrincipal.cpp
index 302e6188cfa..9d562592a36 100644
--- a/caps/nsPrincipal.cpp
+++ b/caps/nsPrincipal.cpp
@@ -111,7 +111,7 @@ nsPrincipal::GetOriginForURI(nsIURI* aURI, nsACString& aOrigin)
     return NS_ERROR_FAILURE;
   }
 
-  nsAutoCString hostPort;
+  nsAutoCString host;
 
   // chrome: URLs don't have a meaningful origin, so make
   // sure we just get the full spec for them.
@@ -120,10 +120,10 @@ nsPrincipal::GetOriginForURI(nsIURI* aURI, nsACString& aOrigin)
   bool isChrome;
   nsresult rv = origin->SchemeIs("chrome", &isChrome);
   if (NS_SUCCEEDED(rv) && !isChrome) {
-    rv = origin->GetAsciiHost(hostPort);
+    rv = origin->GetAsciiHost(host);
     // Some implementations return an empty string, treat it as no support
     // for asciiHost by that implementation.
-    if (hostPort.IsEmpty()) {
+    if (host.IsEmpty()) {
       rv = NS_ERROR_FAILURE;
     }
   }
@@ -159,6 +159,15 @@ nsPrincipal::GetOriginForURI(nsIURI* aURI, nsACString& aOrigin)
   }
 
   if (NS_SUCCEEDED(rv) && !isChrome) {
+    nsAutoCString hostPort;
+    if (host.FindChar(':') != -1) {
+      hostPort.Assign("[");
+      hostPort.Append(host);
+      hostPort.Append("]");
+    } else {
+      hostPort.Assign(host);
+    }
+
     if (port != -1) {
       hostPort.Append(':');
       hostPort.AppendInt(port, 10);
diff --git a/caps/tests/unit/test_origin.js b/caps/tests/unit/test_origin.js
index c0b98d469d6..8ec957428d1 100644
--- a/caps/tests/unit/test_origin.js
+++ b/caps/tests/unit/test_origin.js
@@ -47,6 +47,12 @@ function run_test() {
   var nullPrin = Cu.getObjectPrincipal(new Cu.Sandbox(null));
   do_check_true(/^moz-nullprincipal:\{([0-9]|[a-z]|\-){36}\}$/.test(nullPrin.origin));
   checkOriginAttributes(nullPrin);
+  var ipv6Prin = ssm.createCodebasePrincipal(makeURI('https://[2001:db8::ff00:42:8329]:123'), {});
+  do_check_eq(ipv6Prin.origin, 'https://[2001:db8::ff00:42:8329]:123');
+  checkOriginAttributes(ipv6Prin);
+  var ipv6NPPrin = ssm.createCodebasePrincipal(makeURI('https://[2001:db8::ff00:42:8329]'), {});
+  do_check_eq(ipv6NPPrin.origin, 'https://[2001:db8::ff00:42:8329]');
+  checkOriginAttributes(ipv6NPPrin);
   var ep = ssm.createExpandedPrincipal([exampleCom, nullPrin, exampleOrg]);
   checkOriginAttributes(ep);
   checkCrossOrigin(exampleCom, exampleOrg);