Mixed scripts blocked applied before HSTS
Reported by
ole...@olegon.ru,
Apr 29 2016
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36 Example URL: http://inima.org Steps to reproduce the problem: 1. Goto to site with included http scripts 2. Scripts blocked curl -I https://inima.org HTTP/1.1 200 OK ....... Strict-Transport-Security: max-age=63072000; includeSubdomains; preload What is the expected behavior? Correct rendering of site pages, even scripts in http-links What went wrong? All scripts and CSS blocked Does it occur on multiple sites: Yes Is it a problem with a plugin? No Did this work before? Yes Suppose, about year ago Does this work in other browsers? Yes Chrome version: 50.0.2661.86 Channel: stable OS Version: Fedora 23 Flash Version: Shockwave Flash 21.0 r0 See at attachment, page did'nt render correctly, when cached http links is appeared... In FF it's no problem...
,
Apr 29 2016
And example URL is HTTPS://inima.org, not http, of course... Sorry.
,
Apr 29 2016
,
Apr 29 2016
HSTS does not avoid mixed scripting warnings in Chrome or any other browser. It's not supposed to work that way. You can look into the upgrade-insecure-requests (+mkwst) feature which is supported by Firefox, Chrome, and Opera: https://w3c.github.io/webappsec-upgrade-insecure-requests/ http://caniuse.com/#feat=upgradeinsecurerequests Though it won't resolve mixed content issues on browsers that don't support this, so I would still suggest working towards ultimately fixing the links on your site.
,
Apr 30 2016
Excuse me, but this is not warning... This is blocked contents... And in Chrome and FF it's displayed correctly... In screenshot above all scripts and CSS ignored...
,
Apr 30 2016
That's correct - as the spec David mentioned says, active content like scripts are blocked if included as HTTP URLs. HSTS is applied after, not before, mixed content blocking.
,
Apr 30 2016
Yes, sorry, I mis-spoke when I said "warning". I meant both the mixed scripting warnings (for passive content) and the blocking (for active content). Both are, per spec, applied before HSTS.
,
May 2 2016
Changing the title to be about what's actually going. |
||||
►
Sign in to add a comment |
||||
Comment 1 by yutak@chromium.org
, Apr 29 2016