Bug 258602 – poster attribute for video element has stricter Mixed Content policies

• Component: Media
• Status: RESOLVED CONFIGURATION CHANGED

[Benjamin]

If you add a poster attribute to the video element it dosen't load the poster, but works fine in other browsers

<video poster="http://camendesign.com/code/video_for_everybody/poster.jpg">
  <source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4">
  <p>Your browser does not support the video tag.</p>
</video>

[Alexey Proskuryakov]

I cannot reproduce this with Safari 17 beta. There is something weird going on with the poster size, as it momentarily shows up having the same size as in Chrome, and then becomes smaller.

[Karl Dubost]

Created attachment 466857 [details]
rendering in safari, firefox, chrome

With 

```
data:text/html,<video poster="http://camendesign.com/code/video_for_everybody/poster.jpg"><source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4"><p>Your browser does not support the video tag.</p></video>
```

Safari Technology Preview  173           19616.1.20.2
Firefox Nightly            116.0a1       11623.6.28
Google Chrome Canary       117.0.5859.0  5859.0


The behavior is totally different.

[Karl Dubost]

with the data: URL the console says:


Refused to load http://camendesign.com/code/video_for_everybody/poster.jpg because it does not appear in the img-src directive of the Content Security Policy.


which is interesting because 
data:text/html,<img src="http://camendesign.com/code/video_for_everybody/poster.jpg">

will work. 

https://searchfox.org/wubkat/rev/0a80aee13182b2feee32d8519e716edf3e876e18/Source/WebCore/html/HTMLVideoElement.cpp#249-262

[Karl Dubost]

Ha this is working.


data:text/html,<video poster="https://camendesign.com/code/video_for_everybody/poster.jpg"><source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4"><p>Your browser does not support the video tag.</p></video>


aka https for the poster URL instead of http.

So the bug is different. It's more about Content Security Policy for the poster attribute.

[Alexey Proskuryakov]

To be clear, I was testing with a local file, containing the code from bug description.

[Benjamin]

I have updated the URL to a codepen illustrating the issue

https://codepen.io/benjaminhoegh/pen/NWEjPXE

[Radar WebKit Bug Importer]

<rdar://problem/111765501>

[Karl Dubost]

after discussions with Anne, it's more about mixed content.

[Anne van Kesteren]

In particular we should be upgrading this request, similar to <img src>.

[Karl Dubost]

This has been fixed. The content is being upgraded now. 
https://codepen.io/editor/webcompat/pen/019d27c7-621f-7ba8-a686-a1b307b5eb87

The console is even displaying a message:

[Warning] The page at https://es-d-6881484120260328-019d27c7-621f-7ba8-a686-a1b307b5eb87.codepen.dev/ requested insecure content from http://camendesign.com/code/video_for_everybody/poster.jpg. This content was automatically upgraded and should be served over HTTPS. (es-d-6881484120260328-019d27c7-621f-7ba8-a686-a1b307b5eb87.codepen.dev, line 11)

[Warning] The page at https://es-d-6881484120260328-019d27c7-621f-7ba8-a686-a1b307b5eb87.codepen.dev/ requested insecure content from http://camendesign.com/code/video_for_everybody/poster.jpg. This content was automatically upgraded and should be served over HTTPS.