search

w3c / webappsec

Web Application Security Working Group repo
https://www.w3.org/groups/wg/webappsec/
Other
608 stars 148 forks source link

Definition of "potentially secure origin" says nonsensical things about "about", and makes about: URLs not potentially secure URLs #505

Open bzbarsky opened 9 years ago

bzbarsky commented 9 years ago

It says:

An origin is said to be potentially secure if the origin’s scheme component is HTTPS, WSS, or about.

There are no origins whose scheme component is "about", because the "about" protocol is not hierarchical.

So per this spec as written, about: URLs are not potentially secure.