Re: [spec-reviews] Strawman spec review for upgrade insecure requests (#54)

> +
> +One downside of fetch (and Firefox/Chrome's implementation of mixed content
> +blocking) is that HSTS is applied after mixed content blocking has happened. So
> +sites that are known to support HTTPS are *still* blocked.
> +
> +This spec allows a site to indicate that its subresouces should be upgraded.
> +However, there is still no way for a site to say, "Upgrade me when I am
> +a subresource, because I know I support HTTPS."
> +
> +## End Notes
> +
> +This draft is a very welcome move towards better handling of mixed content
> +blocking. However, in its current form, it entirely depends on the *embedding*
> +site setting the CSP header. We would like to see ways for the *embedded* sites
> +to assert that they must be upgraded and explore allowing user agents to
> +remember which sites have been successfully upgraded for future reference.

Embedded as in `<img>`, not as in `<iframe>`, right? Because the latter is certainly covered.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/spec-reviews/pull/54/files#r29022779