[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #4 from David Dorwin <ddorwin@google.com> ---
(In reply to Joe Steele from comment #2)
...
> I am in favor of #1. 
> 
> However this could cause mixed security messaging, given that the media
> resources themselves are unlikely to be on secure origins for cost and
> performance reasons. The key request origins may also not be secure (again
> for performance reasons) if the key request protocol uses message-based
> security rather than relying on a TLS channel. How would applications handle
> this?

These would be mixed content scenarios, which should be addressed by
https://w3c.github.io/webappsec/specs/mixedcontent/.

> An easier problem -- what would failure mean here? Would this be handled
> with an error code?

Failure would mean the promise returned by MediaKeys::create() is rejected. We
would need to specify the DOMException name with which to reject.
"NotSupportedError" is consistent with other requests where the requested key
system cannot be used. Details could be provided in the DOMException message.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Saturday, 19 July 2014 00:18:41 UTC