search

futpib / policeman

Firefox extention for cross-site requests control (kind of RequestPolicy clone)
https://addons.mozilla.org/en-US/firefox/addon/policeman/
143 stars 11 forks source link

Suggestion: option to block all http requests and option to block all http requests on https pages #113

Closed Halibut80 closed 9 years ago

heforfree commented 9 years ago

@futpib also look this #61

futpib commented 9 years ago

Is this what "https sandbox" ruleset does? Check reject_http for the other part of your request.

heforfree commented 9 years ago

in pre9 if i put reject_http on top of ruleset it pervent from me going to site.this is are in HTTP Nowhere image 1 image 2

but pre10 it allow http request HTTP Nowhere Version 2.0.2 do somthing like pre9 but problem with pre9 is if put reject_http on top and then make some temp or persistent rule it wont work because first match wins

futpib commented 9 years ago

@heforfree I don't get it. Do you think that navigation to http pages has to be prevented?

heforfree commented 9 years ago

@futpib when enable reject_http ruleset then yes it must block go to site then with this rulset user can create 100% trusted domain.with this way user can control every request that firefox make or addon make request example firefox make request to ocsp.digicert.com and many other request policeman can not block this request anyway i see it make too Complex so if you want close this

0xBRM commented 9 years ago

I'm confused. Does policeman lack the ability to enforce strict HTTPS on demand (no mixed content)?

futpib commented 9 years ago

@CrisBRM Policeman can block http content on https pages by means of "https sandbox" ruleset. In fact Firefox is also able to do that out-of-box (see #134).