Quite possibly also affects mobile; add labels if so.

We currently treat HTTP form actions as "mixed content" and downgrade the indicator as we would for passive mixed content (e.g., insecure images).

Going forward this may be mis-aligned with our increasing HTTP-Bad efforts.

This is not a security bug, per se, but we should track this as followup work for how we handle HTTP in Chrome. I agree that HTTP-forms-on-HTTPS pages is potentially _more_ concerning than HTTP-forms-on-HTTP pages (and we downgrade the indicator to "Dangerous" in that case on form edit now). We may want to try to align this case with the HTTP page behavior at least.

For comparison, I've attached screenshots of the behavior of Safari Technology Preview and Firefox Nightly. Safari downgrades the security indicator (does not show the lock icon) and displays a prompt when the user tries to submit the form with a warning. Firefox shows the lock icon, but displays a prompt when the users tries to submit.

We have generally avoided warnings like this, however, but this may be rare enough to not be as concerning as other warnings would be. Unfortunately, I think then only related metric we have is our generic mixed content use counter, which doesn't distinguish the type of mixed content. I think we're planning to add metrics that would cover this case though.

Per the Mixed Content spec, we have fairly wide latitude on how we handle insecure form actions (https://www.w3.org/TR/mixed-content/#requirements-forms). We may warn users, or even treat it as blockable mixed content.

+cc some other folks who may have thoughts about this.

Deleted: Safari Tech Preview Mixed Form Warning.png 86.3 KB

	Safari Tech Preview Mixed Form Warning.png 86.3 KB View Download

Deleted: Firefox Nightly Mixed Form Warning.png 96.7 KB

	Firefox Nightly Mixed Form Warning.png 96.7 KB View Download

Since we don't have Chrome metrics for this yet, I did a quick check of the HTTP Archive. My query (below) indicates that potentially 2.44% of pages are HTTPS and have an HTTP form action (this might under-count because it is only root pages on those domains).

#standardSQL
SELECT
  AVG(IF(has_insecure_form_action
      AND STARTS_WITH(LOWER(url),
        "https://"), 1, 0)) AS p_insecure_forms
FROM (
  SELECT
    url,
    REGEXP_CONTAINS(LOWER(body),
      r'action=(\"|\')?http:\/\/') AS has_insecure_form_action
  FROM
    `httparchive.response_bodies.2018_10_01_desktop`
  WHERE
    page = url )

Going through the HTMLFormElement blink code I realized we do have a blink UseCounter for mixed content forms being present. Looks like the current value is around 0.23% of navigations have one. (https://www.chromestatus.com/metrics/feature/popularity#MixedContentFormPresent)

We also have one for actual submissions, which are much lower at around 0.02%. (https://www.chromestatus.com/metrics/feature/popularity#MixedContentFormsSubmitted)