search

w3c / webappsec-mixed-content

WebAppSec Mixed Content
https://w3c.github.io/webappsec-mixed-content/
Other
12 stars 22 forks source link

Clarify treatment of CORS-enabled requests #50

Open letitz opened 3 years ago

letitz commented 3 years ago

Section 3.1. Upgradeable Content states:

We further limit this category in § 4.4 Should fetching request be blocked as mixed content? by force-failing any CORS-enabled request. This means, for example, that mixed content images loaded via <img crossorigin ...> will be blocked.

However section 4.4. Should fetching request be blocked as mixed content? does not seem to make such an exception.

At least one of the two sections seems like it needs revising. Which is it?

annevk commented 3 years ago

As long as we keep

The user agent has been instructed to allow mixed content, as described in § 7.2 User Controls).

I suspect the latter should be modified so that even when the user allows mixed content requests, it's still not allowed for CORS. I think Mozilla would be okay with dropping the UI overrides at this point though.