Upgrading inactive/passive subresource requests and fetches in would-be mixed security contexts is the new standard: https://www.w3.org/TR/mixed-content/#category-upgradeable
<rdar://problem/101678657>
Drive-by comment, is this the same as bug 219396 (though the other seems to have more details)?
More or less the same, yes. I was tempted to mark this as a duplicate, but there is a slight difference in scope: bug #219396 additionally envisions removing internal settings and deprecating public settings, and that requires some Linux-specific changes that Apple engineers might not be comfortable with making, but would be very easy for me to do in a follow-up patch in that bug if the main work were to be handled in this bug. So I'll leave it for Matthew to decide whether to leave them both open or mark this one as a duplicate.
(In reply to Frederik Braun (Mozilla) from comment #2) > Drive-by comment, is this the same as bug 219396 (though the other seems to > have more details)? Oh, indeed! My apologies for missing that bug 219396 already includes this. (In reply to Michael Catanzaro from comment #3) > More or less the same, yes. I was tempted to mark this as a duplicate, but > there is a slight difference in scope: bug #219396 additionally envisions > removing internal settings and deprecating public settings, and that > requires some Linux-specific changes that Apple engineers might not be > comfortable with making, but would be very easy for me to do in a follow-up > patch in that bug if the main work were to be handled in this bug. So I'll > leave it for Matthew to decide whether to leave them both open or mark this > one as a duplicate. I like that plan. Let's focus on only upgrading http requests here, and then bug 219396 can track the remaining pieces (possibly as a meta bug).
Pull request: https://github.com/webkit/WebKit/pull/9577
Pull request: https://github.com/WebKit/WebKit/pull/9577
Committed 274409@main (8a3335648a55): <https://commits.webkit.org/274409@main> Reviewed commits have been landed. Closing PR #9577 and removing active labels.
http/tests/navigation/ping-attribute/area-cross-origin-from-https-UpgradeMixedContent.html is a flaky failure. bug#269223 tracks the bug.