This is working-as-specced, but I agree that it's confusing. This is something we hope to address with https://mikewest.github.io/hsts-priming/.

Apologies if these are stupid questions:

Looking at https://fetch.spec.whatwg.org/#main-fetch point 7 I was under the impression that it wasn't to spec: "Set request's current url's scheme to "https" if all of the following conditions are true....", one of which is HSTS.

At the moment the behavior between Firefox and Chrome is different, is Chrome to spec and Firefox implementing some of the proposed changes in the linked doc?

Ah. I think I should actually read the bug before repling to what I think you're asking:

> Looking at https://fetch.spec.whatwg.org/#main-fetch point 7

Mixed content checking happens in step 5, so:

* `fetch` should block the request before it zings through HSTS, because it's blockable mixed content.

* `<img>` will degrade the omnibox by making it less green, then hit the //net stack where it's upgraded to HTTPS before it hits the network. You'll see a 307 status in devtools, which is an internal detail of the way our network stack works.

It does look like there's a bug in the latter, in that we're not applying HSTS before we send the request to the service worker. You're entirely correct that the service worker shouldn't see the `http`. Reassigning to horo@ to take a look (though I think this is going to be a bit difficult to fix, given the way things are layered at the moment).

In the steps above, it's a HTTP page requesting a HTTPS resource, so the mixed content warning shouldn't be a problem here.

The SW issue I actually hit via localhost testing of a library - at which point I spotted the difference between FF and Chrome.

thanks for looking into this Mike.

Mike: Is HSTS Priming still going on? I'm wondering if this is WontFix/WorkingAsIntended otherwise =)

Priming is dead. Long live automatic upgrading in MIX2 (https://github.com/mikewest/webappsec-mixed-content/blob/master/proposed-level-2-roadmap.md).

That said, if there are still behavioral differences between our implementation and Firefox's for service workers, we should look into that.