Bug 157885
| Summary: | CSP: Account for HSTS when deciding whether to send the 'Upgrade-Insecure-Requests' Header | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Brent Fulgham <bfulgham> |
| Component: | WebCore Misc. | Assignee: | Brent Fulgham <bfulgham> |
| Status: | NEW | ||
| Severity: | Normal | CC: | bfulgham, csaavedra, mcatanzaro, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | 143653 | ||
| Bug Blocks: | |||
Brent Fulgham
The 'Upgrade-Insecure-Requests' specification <https://w3c.github.io/webappsec/specs/upgrade/> suggests an optimization to sending the header, limiting it to sites that are not known canonical HSTS targets.
We should implement this check and avoid adding the header when it is not needed.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/26374345>
Michael Catanzaro
There's a FIXME for this in FrameLoader::addHTTPUpgradeInsecureRequestsIfNeeded.