W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2015

Re: CfC: Mixed Content to PR; deadline July 6th.

From: Anne van Kesteren <annevk@annevk.nl>
Date: Mon, 20 Jul 2015 06:08:04 -0700
Message-ID: <CADnb78ikbLKu45CQ=x6er=UhbPHa6t0QPchzLk_3ZSLTFDTtcw@mail.gmail.com>
To: Mike West <mkwst@google.com>
Cc: Brian Smith <brian@briansmith.org>, Brad Hill <hillbrad@gmail.com>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, Kristijan Burnik <burnik@google.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Alex Russell <slightlyoff@google.com>, Ryan Sleevi <sleevi@google.com>
On Mon, Jul 20, 2015 at 6:02 AM, Mike West <mkwst@google.com> wrote:
> The case I'm interested in is a secure document which executes
> `fetch([insecure URL goes here])`. Does the current language block it? I
> believe it does, as the request's `window` will be either `client` or
> `no-window`? Is that how you intended the `window` property to work?

I see, I didn't mean to block that. But if you want to block that, you
could: "If request's client is request's window, return *blocked*."

Received on Monday, 20 July 2015 13:08:31 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:50 UTC