Re: [fetch] Exempt HSTS-upgraded resources from mixed content blocking (#150) from Anne van Kesteren on 2015-11-05 (public-webapps-github@w3.org from November 2015)

From: Anne van Kesteren <notifications@github.com>
Date: Thu, 05 Nov 2015 06:25:47 -0800
To: whatwg/fetch <fetch@noreply.github.com>
Message-ID: <whatwg/fetch/issues/150/154073087@github.com>

The concern is that once you do a HSTS preflight using HTTPS that is successful, it would be sad to have to create a new connection for the actual request over HTTPS. So it would be nice to either use credentials for both or neither, depending on the characteristics of the actual request.

(Interesting point about blocking port 443 and that defeating the navigation use case, hadn't thought of that.)

---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/150#issuecomment-154073087

Received on Thursday, 5 November 2015 14:26:16 UTC