Hi, sorry it took a while to respond! > all (http) downloads whose URLs are exempted will be downloaded over HTTP That is what we want! I think we actually have a bug open because that's not happening right now. > And what is the expected behavior when redirects are involved I'm pretty sure any redirects are handled by the HTTPS-Only Code within necko, so that shouldn't be a problem either. > Based on the observation that subresource requests inherit the exemption from the document, I expect that the same would apply to downloads? You're right, we're not fixing the inheritance issue with this. But it seems there is no easy fix for that insight. So I think we should do the simple fix here and then think long-term about how to address the other (valid issues). In our meeting, you talked about a general extension API proposal, where extensions can work within the security context of a page. How far along is that?
Bug 1685862 Comment 12 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Hi, sorry it took a while to respond! > all (http) downloads whose URLs are exempted will be downloaded over HTTP That is what we want! I think we actually have a bug open because that's not happening right now. > And what is the expected behavior when redirects are involved I'm pretty sure any redirects are handled by the HTTPS-Only Code within necko, so that shouldn't be a problem either. > Based on the observation that subresource requests inherit the exemption from the document, I expect that the same would apply to downloads? You're right, we're not fixing the inheritance issue with this. But it seems there is no easy fix for that insight. So I think we should do the simple fix here and then think long-term about how to address the other (valid issues). In our meeting, you talked about a general extension API proposal, where extensions can work within the security context of a page. How far along is that?