Re: [spec-reviews] Strawman spec review for upgrade insecure requests (#54)

> +
> +### IDEA: Allow Sites to Signal That They Are Upgradeable Resources
> +
> +One downside of fetch (and Firefox/Chrome's implementation of mixed content
> +blocking) is that HSTS is applied after mixed content blocking has happened. So
> +sites that are known to support HTTPS are *still* blocked.
> +
> +This spec allows a site to indicate that its subresouces should be upgraded.
> +However, there is still no way for a site to say, "Upgrade me when I am
> +a subresource, because I know I support HTTPS."
> +
> +## End Notes
> +
> +This draft is a very welcome move towards better handling of mixed content
> +blocking. However, in its current form, it entirely depends on the *embedding*
> +site setting the CSP header. We would like to see ways for the *embedded* sites

@annevk as well, for Fetch. It's a trivial change to Fetch, but a more complicated change to browsers and to the meaning of HSTS, which is why HSTS folks ought to be involved.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/spec-reviews/pull/54/files#r29798258