New issue
Advanced search Search tips

Issue 614375 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 3
Type: Bug



Sign in to add a comment

Handle Mixed Content passthrough requests as per ServiceWorker spec

Project Member Reported by surma@google.com, May 24 2016

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36

Steps to reproduce the problem:
1. Serve this website over HTTPS:

index.html:
```
<img src="http://i.imgur.com/ztApnbv.jpg">
<script>
navigator.serviceWorker.register('sw.js');
</script>
```

sw.js
```
self.addEventListener('fetch', ev => ev.respondWith(fetch(ev.request)));
```
2. Go to hosted site, see the linked image being loaded
3. Refresh, see the linked image being blocked

I have hosted this example here: https://f.surma.link/sw-passthrough/

What is the expected behavior?
The image should still load, as stated by the SW spec:

https://w3c.github.io/webappsec-mixed-content/#is-passthrough

What went wrong?
Mixed content is blocked when it is loaded through a service worker, even if it is passive content.

Did this work before? No 

Chrome version: 50.0.2661.102  Channel: stable
OS Version: OS X 10.11.4
Flash Version: Shockwave Flash 21.0 r0
 
index.html
105 bytes View Download
sw.js
73 bytes View Download

Comment 1 by rsesek@chromium.org, May 24 2016

Components: Blink>ServiceWorker Blink>SecurityFeature

Comment 2 by surma@chromium.org, May 24 2016

Cc: jakearchibald@chromium.org

Comment 3 by falken@chromium.org, May 27 2016

Labels: -Pri-2 Pri-3
Owner: horo@chromium.org
Status: Assigned (was: Unconfirmed)
surma@ is it ok to remove Restrict-View-Google? I see nothing secret here., and it looks like not a security bug  (the bug is that we're being too restrictive).

Tentatively assigning to horo@.

Comment 4 by surma@google.com, May 27 2016

Yes go ahead. Used my @google account by accident, actually.

Comment 5 by falken@chromium.org, May 27 2016

Labels: allpublic
Project Member

Comment 6 by sheriffbot@chromium.org, Jun 2 2016

Labels: Hotlist-Google
Labels: -Hotlist-Google

Comment 8 by est...@chromium.org, Nov 10 2017

Labels: Hotlist-EnamelAndFriendsFixIt

Comment 9 by est...@chromium.org, Feb 18 2018

Labels: -Hotlist-EnamelAndFriendsFixIt

Sign in to add a comment