1133712 - Block all Mixed Content for HSTS domains

Status: RESOLVED WONTFIX

(Core :: Security, defect)

Description

[Anne (:annevk)]

Internet Explorer plans on blocking all mixed content for HSTS domains: http://blogs.msdn.com/b/ie/archive/2015/02/16/http-strict-transport-security-comes-to-internet-explorer.aspx

If that is feasible it seems preferable to sometimes changing the UI and confusing the end user.

Comment 2

[Tanvi Vyas[:tanvi]]

Reopening as this is slightly different than bug 800098.

Bug 800098 is about removing the user override in HSTS pages.  I believe this bug is about treating optionally blockable content as blockable on HSTS pages.

Comment 3

[Daniel Veditz [:dveditz]]

This bug does not accurately reflect the IE team's plans.

"Mixed content – We do allow audio/video in the mixed mode scenario as it applies to HSTS."

http://blogs.msdn.com/b/ie/archive/2015/02/16/http-strict-transport-security-comes-to-internet-explorer.aspx#10594412

I vote WONTFIX, it'll just be a reason for people to regret having used HSTS.

Comment 4

[Anne (:annevk)]

Agreed that would make the proposition far less attractive.

Comment 5

[Tanvi Vyas[:tanvi]]

I just commented on the IE blog as I'd like some clarification from them either way.

Comment 6

[Tanvi Vyas[:tanvi]]

(In reply to Tanvi Vyas [:tanvi] from comment #5)
> I just commented on the IE blog as I'd like some clarification from them
> either way.

Mixed active content will be blocked on HSTS pages without a user override.
http://blogs.msdn.com/b/ie/archive/2015/02/16/http-strict-transport-security-comes-to-internet-explorer.aspx?CommentPosted=true#10597765