Re: Mixed content warnings for cross-site requests

On 2008-02-26 02:16:50 -0800, Jonas Sicking wrote:

> I think in general a UA should warn the user that a connection is
> about to be made over a non-https connection and give the user
> the option to abort the request.

There's a reason why these kinds of dialogues are called "idiot
boxes" by folks in the usability community.  Before recommending any
particular UI behavior in terms of security warnings, please talk to
the people in the Web Security Context WG about that.

> Not sure if this needs to be mentioned in the access-control
> spec, but it doesn't hurt I suppose. In general I don't think
> these requests should be treated any differently from any other
> requests though.

It actually does hurt (for various reasons), and talking about user
interactions for mixed content *is* on the WSC WG's plate.

Regards,
-- 
Thomas Roessler, W3C  <tlr@w3.org>