search

w3c / webappsec-upgrade-insecure-requests

WebAppSec Upgrade Insecure Requests
https://w3c.github.io/webappsec-upgrade-insecure-requests/
Other
7 stars 15 forks source link

Explicitly mention if downloads should be upgraded to HTTPS or not #16

Open ckerschb opened 5 years ago

ckerschb commented 5 years ago

We have had a bug filed [1] where apparently Firefox upgrades a download and Chrome does not. In Firefox' implementation, following the link in the bug creates a new tab - according to the spec we consider that a new same origin top-level navigation, so we upgrade the link/download from http to https. Chrome apparently doesn't upgrade the link/download.

The spec isn't explicit about that - can we fix that?

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1530577

annevk commented 5 years ago

So ultimately we want downloads to work very similar to navigations, follow the same code path in fact (this is not the case in the HTML Standard at the moment), so

<a href=http://same-origin.example/>test</a>
<a href=http://same-origin.example/ download>test</a>

should work the same I'd think.

ckerschb commented 5 years ago

@mikewest it seems that Chrome must have a basic problem for upgrading top-level same-origin navigations, because the upgrading should happen long before the browser detects the link results in a download or not. Am I right? Can you put me in contact with the developer working on UIR in Chrome?