search

w3c / webappsec-mixed-content

WebAppSec Mixed Content
https://w3c.github.io/webappsec-mixed-content/
Other
12 stars 22 forks source link

WebSocket section needs updating #27

Closed annevk closed 3 years ago

annevk commented 4 years ago

It looks very unaware of the current status quo of WebSocket specifications (which might soonish change again, but updates to reference Fetch and HTML as appropriate would be good).

mikewest commented 4 years ago

Hrm. Interesting! I guess we're not using the RFC at all anymore... Looking at Fetch and HTML, I'm not actually sure there's any monkey-patching to do. I'll just reword the integration with HTML/Fetch sections to highlight how they affect WebSockets as well.

domenic commented 4 years ago

I ran into this today. It looks like you could just delete https://w3c.github.io/webappsec-mixed-content/#websockets-integration, or replace it with a sentence pointing to the fact that https://fetch.spec.whatwg.org/#websocket-protocol means that mixed content blocking automatically applies to WebSockets too.