[Bug 27271] Normatively require https for all ancestor origins when requiring https at all

https://www.w3.org/Bugs/Public/show_bug.cgi?id=27271

--- Comment #6 from Ryan Sleevi <sleevi@google.com> ---
(In reply to David Dorwin from comment #5)
> (In reply to Ryan Sleevi from comment #2)
> > Would it be possible / should we incorporate the language from
> > https://w3c.github.io/webappsec/specs/mixedcontent/#may-document-use-
> > powerful-features , which makes it clearer as to the algorithm necessary to
> > process this?
> 
> Yes, we should reference a central definition of expected behavior. Does
> this algorithm cover the scenarios about which Henri is concerned?

While I can't speak for Henri, from what I read of what he said, this
absolutely matches his proposal in a central fashion (with the added bit that
the different sections address different concepts w/r/t browser context vs
document, but the same behaviours across)

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Tuesday, 11 November 2014 02:16:26 UTC