247197 2022-10-28 08:08:31 -0700 Upgrade requests in mixed content settings 2024-09-07 12:01:51 -0700 1 1 1 Unclassified WebKit Page Loading Safari Technology Preview Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=269172 https://bugs.webkit.org/show_bug.cgi?id=279249 InRadar P2 Normal --- 140625 219396 1 m_finkel m_finkel beidson fbraun fujii mcatanzaro webkit-bug-importer oldest_to_newest 1909021 0 m_finkel 2022-10-28 08:08:31 -0700 Upgrading inactive/passive subresource requests and fetches in would-be mixed security contexts is the new standard: https://www.w3.org/TR/mixed-content/#category-upgradeable 1909022 1 webkit-bug-importer 2022-10-28 08:08:44 -0700 <rdar://problem/101678657> 1914047 2 fbraun 2022-11-22 04:31:16 -0800 Drive-by comment, is this the same as bug 219396 (though the other seems to have more details)? 1914079 3 mcatanzaro 2022-11-22 06:58:22 -0800 More or less the same, yes. I was tempted to mark this as a duplicate, but there is a slight difference in scope: bug #219396 additionally envisions removing internal settings and deprecating public settings, and that requires some Linux-specific changes that Apple engineers might not be comfortable with making, but would be very easy for me to do in a follow-up patch in that bug if the main work were to be handled in this bug. So I'll leave it for Matthew to decide whether to leave them both open or mark this one as a duplicate. 1914989 4 m_finkel 2022-11-28 08:34:24 -0800 (In reply to Frederik Braun (Mozilla) from comment #2) > Drive-by comment, is this the same as bug 219396 (though the other seems to > have more details)? Oh, indeed! My apologies for missing that bug 219396 already includes this. (In reply to Michael Catanzaro from comment #3) > More or less the same, yes. I was tempted to mark this as a duplicate, but > there is a slight difference in scope: bug #219396 additionally envisions > removing internal settings and deprecating public settings, and that > requires some Linux-specific changes that Apple engineers might not be > comfortable with making, but would be very easy for me to do in a follow-up > patch in that bug if the main work were to be handled in this bug. So I'll > leave it for Matthew to decide whether to leave them both open or mark this > one as a duplicate. I like that plan. Let's focus on only upgrading http requests here, and then bug 219396 can track the remaining pieces (possibly as a meta bug). 1930730 5 m_finkel 2023-02-02 18:55:35 -0800 Pull request: https://github.com/webkit/WebKit/pull/9577 1938391 6 m_finkel 2023-03-02 19:22:33 -0800 Pull request: https://github.com/WebKit/WebKit/pull/9577 2012432 7 ews-feeder 2024-02-09 21:12:11 -0800 Committed 274409@main (8a3335648a55): <https://commits.webkit.org/274409@main> Reviewed commits have been landed. Closing PR #9577 and removing active labels. 2012834 8 fujii 2024-02-12 12:21:29 -0800 http/tests/navigation/ping-attribute/area-cross-origin-from-https-UpgradeMixedContent.html is a flaky failure. bug#269223 tracks the bug.