W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2015

Re: CfC: Mixed Content to PR; deadline July 6th.

From: Mike West <mkwst@google.com>
Date: Mon, 20 Jul 2015 15:02:27 +0200
Message-ID: <CAKXHy=cavPgHb1vc-9A0omi+FOTsRpav6XeNJKJebQCFSjN=6w@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: Brian Smith <brian@briansmith.org>, Brad Hill <hillbrad@gmail.com>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, Kristijan Burnik <burnik@google.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Alex Russell <slightlyoff@google.com>, Ryan Sleevi <sleevi@google.com>
On Mon, Jul 20, 2015 at 2:57 PM, Anne van Kesteren <annevk@annevk.nl> wrote:

> > Would you suggest allowing documents to `fetch()` things as well?
>
> I'm not sure what you're saying here. Yes?


I think what I was saying here was "Hey, Anne. I can't read. Can you please
read things to me?" :)

https://github.com/w3c/webappsec/commit/e577d4d5746bd33248a7dd4dbe0db515c16f20fb#diff-797d64e19b34e971e000935ac95e9255
is a stab at the limitations that seem like they address the concerns here.
WDYT?

The case I'm interested in is a secure document which executes
`fetch([insecure URL goes here])`. Does the current language block it? I
believe it does, as the request's `window` will be either `client` or
`no-window`? Is that how you intended the `window` property to work?

-mike
Received on Monday, 20 July 2015 13:03:17 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:13 UTC