[Bug 27271] Normatively require https for all ancestor origins when requiring https at all

https://www.w3.org/Bugs/Public/show_bug.cgi?id=27271

--- Comment #8 from Mike West <mkwst@google.com> ---
(In reply to Henri Sivonen from comment #7)
> I think it makes sense to reference that algorithm. It tries to do what I
> want. I'm not 100% sure it currently does what I want, but if it doesn't, it
> seems clear I should file a bug on that spec instead instead of proposing a
> different algorithm here. (Specifically, it's unclear to me what step 3 does
> if the branch in step 2 is not taken.)

Ah, yes. That was silly.

The new step 2 now sets `origin` even if the document isn't sandboxed:
<https://w3c.github.io/webappsec/specs/mixedcontent/#may-document-use-powerful-features>.
Sorry about that!

More bug reports welcome; that spec is going into last call on Thursday, so
right now is a _brilliant_ time to skim it and tell me how broken it is. :)

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Tuesday, 11 November 2014 10:07:32 UTC