W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2015

Re: CfC: Mixed Content to PR; deadline July 6th.

From: Brian Smith <brian@briansmith.org>
Date: Tue, 7 Jul 2015 10:16:16 -0400
Message-ID: <CAFewVt6siv1uAgSGK68_veUrqg996CB=Ckp4PqcKyRsRjCFovg@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: Ryan Sleevi <sleevi@google.com>, Mike West <mkwst@google.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Dan Veditz <dveditz@mozilla.com>, Wendy Seltzer <wseltzer@w3.org>, Brad Hill <hillbrad@gmail.com>, Kristijan Burnik <burnik@google.com>
Anne van Kesteren <annevk@annevk.nl> wrote:

> On Mon, Jul 6, 2015 at 8:14 PM, Brian Smith <brian@briansmith.org> wrote:
> > Having MIX talk only about pre-connection/pre-fetching blocking wouldn't
> > restrict other specifications (or even later versions of MIX) from
> > specifying post-connection blocking.
> The response blocking is required for service workers. We shouldn't remove
> it.

Sorry, but I don't understand how a service worker can even access
non-secure resources. In particular, since only secure origins can use
service workers, any use of fetch() by a service worker to fetch a
non-secure resource will fail due the pre-connect blocking in section 5.2.
Could you show an example of when post-connect blocking is needed by
service workers? A link to a test case for post-connect blocking in Firefox
would be OK.

Received on Tuesday, 7 July 2015 14:16:45 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:49 UTC