W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2015

Re: CfC: Mixed Content to PR; deadline July 6th.

From: Anne van Kesteren <annevk@annevk.nl>
Date: Mon, 20 Jul 2015 14:57:10 +0200
Message-ID: <CADnb78j_F1v_jSeX7NQ2f2f_AqcFAVKPfkKwHh6x9ra64zOF6Q@mail.gmail.com>
To: Mike West <mkwst@google.com>
Cc: Brian Smith <brian@briansmith.org>, Brad Hill <hillbrad@gmail.com>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, Kristijan Burnik <burnik@google.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Alex Russell <slightlyoff@google.com>, Ryan Sleevi <sleevi@google.com>
On Mon, Jul 20, 2015 at 2:51 PM, Mike West <mkwst@google.com> wrote:
> Wouldn't that allow `fetch([insecure url goes here], { window: null })` in a
> document?

It would allow that to be blocked based on Mixed Content not allowing
mixed content when window is "no-window". Seems like a good feature.

> I might be misreading the bits around
> https://fetch.spec.whatwg.org/#dom-request, but it seems like "no-window"
> can be set imperatively.


> My goal would be to limit the carveout to the `self.onfetch = function
> (event) { event.respondWith(fetch(event.request)); }` case. Is that too
> limiting?

That case would have an associated window (unless the document set it
to null), since it got copied from event.request.

> Would you suggest allowing documents to `fetch()` things as well?

I'm not sure what you're saying here. Yes?

Received on Monday, 20 July 2015 12:57:35 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:50 UTC