Re: UPGRADE: 'HTTPS' header causing compatibility issues. from Richard Barnes on 2015-07-08 (public-webappsec@w3.org from July 2015)

From: Richard Barnes <rbarnes@mozilla.com>
Date: Wed, 8 Jul 2015 10:08:07 -0700
To: Martin Thomson <martin.thomson@gmail.com>
Cc: Mike West <mkwst@google.com>, Adrian Hope-Bailie <adrian@hopebailie.com>, Ilya Grigorik <igrigorik@google.com>, Anne van Kesteren <annevk@annevk.nl>, "Nottingham, Mark" <mnotting@akamai.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>
Message-ID: <CAOAcki8+nooeGorXVyGWzToz=Z-Yi0oWF+C5ukLNvgTCj9=HnQ@mail.gmail.com>

On Wed, Jul 8, 2015 at 9:29 AM, Martin Thomson <martin.thomson@gmail.com>
wrote:

> On 8 July 2015 at 07:53, Mike West <mkwst@google.com> wrote:
> > `upgrade-insecure-requests: 1`, going once, going twice...
>
>
> OK, I'll bite.  -requests seems unnecessarily verbose.  I mean, yes,
> we do want to be precise and clear, but `upgrade-insecure` seems
> enough; though only if you also change the CSP directive name I
> suppose.
>

Please, let's just have the header name match the directive name.

Received on Wednesday, 8 July 2015 17:08:35 UTC