179049 2017-10-31 01:58:04 -0700 `<picture>` and `<img srcset>` ought to be treated as "blockable" mixed content. 2023-07-05 16:09:05 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified NEW BrowserCompat, InRadar, WPTImpact P2 Normal --- 140625 1 mkwst webkit-unassigned ahmad.saleem792 annevk bfulgham dbates webkit-bug-importer wilander oldest_to_newest 1366347 0 mkwst 2017-10-31 01:58:04 -0700 The Mixed Content spec carves out blockable subsets of `<img>` (step 4 of https://w3c.github.io/webappsec-mixed-content/#should-block-fetch) as a first step towards tightening mixed content restrictions more generally. WebKit currently treats these as optionally-blockable. See, for example, tests at https://w3c-test.org/mixed-content/picture-tag/no-opt-in/same-host-http/top-level/swap-scheme-redirect/blockable/no-opt-in-blocks.https.html and https://w3c-test.org/mixed-content/imageset.https.sub.html, which Chrome and Firefox currently agree on. 1366452 1 webkit-bug-importer 2017-10-31 10:46:40 -0700 <rdar://problem/35275253> 1964334 2 ahmad.saleem792 2023-06-29 15:15:48 -0700 WPT - https://wpt.live/mixed-content/imageset.https.sub.html I am unable to find other one. Might be? https://wpt.fyi/results/mixed-content/gen/top.meta/unset/picture-tag.https.html?label=master&label=experimental&aligned=&q=picture 1965216 3 annevk 2023-07-05 16:09:05 -0700 The requirement for `imageset` (which <picture> and <img srcset> both use) is here these days: https://w3c.github.io/webappsec-mixed-content/#upgrade-algorithm