Issue metadata
Sign in to add a comment
|
Prevent users from creating http exceptions for permissions that are https only
Reported by
christop...@gmx.com,
Jan 2 2018
|
||||||||||||||||||||||||||
Issue descriptionChrome Version : 62+ URLs (if applicable) : all http domains Other browsers tested: all Chromium based browsers are affected What steps will reproduce the problem? (1) add an exception for notifications on any http domain, e.g. http://www.bennish.net/web-notifications.html (2) try to display a notification on this very site What is the expected result? The exception explicitly whitelists this http domain, hence I'd expect the notifications to work or any kind of clue that this exception is invalid. What happens instead? Continues to be blocked although explicitly whitelisted without any hint about what's wrong. https://www.chromestatus.com/feature/5759967025954816 doesn't describe this case.
,
Jan 2 2018
,
Jan 3 2018
we block notifications from insecure sites before they hit the content settings system. Agreed that we could also block such content settings from being created.
,
Jan 3 2018
christoph142@ Thanks for the issue. Able to reproduce this issue on Win-10, Mac OS 10.12.6 and Ubuntu 14.04 using chromium build 52.0.2716.0 and the latest Chromium build 63.0.3239.108. On Navigating to the above given URL http://www.bennish.net/web-notifications.html and clicking on 'Show' and 'Show in 5s' buttons, can see messages like 'Notification #1 errored'. Attached are the screen shots for reference. This is a non-regression issue as it is observed from M52 old chromium builds. Hence, marking it as Untriaged for updates from dev team. Thanks...
,
Jan 7 2018
Raymes, could you take a look at this? Can we easily block the user from creating content settings that try to allow privileges that are disallowed on insecure origins?
,
Jan 8 2018
Yes, we should probably prevent users from adding exceptions for http sites for permissions that are https only. +patricialor but this is lower priority.
,
Jan 8 2018
,
Jan 9 2018
Hi! Our dev url looks like mgruzdev.local We can't install https on it 'by design' We can only add exception in settings. If you plan to remove exceptions, how should devs debug notifications? On production?
,
Jan 9 2018
The idea is to prevent adding adding exceptions for cases where notifications will be blocked anyway. Notifications are already blocked on all http sites. The change proposed won't break anything new.
,
Jan 10 2018
Cool.Where could I ask for workaround?
,
Jan 11 2018
I'm not exactly sure what you're asking for a workaround for?
,
Mar 31 2018
So there's a Milestone here, but this didn't make it into 65, did it?
,
Aug 17
|
|||||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||||
Comment 1 by dtapu...@chromium.org
, Jan 2 2018