1184337 - Investigate if ImageLib cache causes wrong scheme in console message in mixed content blocker

Status: NEW

(Core :: DOM: Security, defect)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

After investigating Bug 1183563, where we incorrectly log a message to the console when the CSP directive upgrade-insecure-requests is used. I am pretty sure we have the same problem for imgLib cache for HSTS.

Steps to investigate:
* Go to a page that uses HSTS and loads an image over http
* Refresh the page so the image is loaded from the cache
* Investigate if the browser console message displays *http* or *https*.

If the console message shows something like:
> Loading insecure mixed content: *https*
it might confuse users because the load is actually secure but still displays a warning.