1633743 - Consider auto upgrading passive mixed content in Nightly

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Christoph Kerschbaumer [:ckerschb}]

We could consider to auto-upgrade mixed passive content like:

• audio, video
• images

from http to https.

Given the current state of the internet, that should probably work.

Comment 2

[Christoph Kerschbaumer [:ckerschb}]

Attachment: Bug 1633743: Auto upgrade mixed display content in Nightly.

Comment 3

[Christoph Kerschbaumer [:ckerschb}]

Let's make sure flipping this pref does not do any harm to TRY:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=fa0a44c5ddd3a5359b9b1487a246025ea9ad9fda

Comment 4

[Christoph Kerschbaumer [:ckerschb}]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=45d03c0c0a3ac7269fd5260e0b0c06a75b4453f8

Comment 5

[Christoph Kerschbaumer [:ckerschb}]

Attachment: Bug 1633743: Auto upgrade mixed display content in Nightly.

Comment 6

[Christoph Kerschbaumer [:ckerschb}]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2a1388ee16f30bf92552ee662a04c287e2f8d757

Comment 7

[Christoph Kerschbaumer [:ckerschb}]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e7d6d42e0f68177b63970472e84f99d93db5f398

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5d0b324f4397
Auto upgrade mixed display content in Nightly. r=annevk

Comment 9

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/5d0b324f4397

Comment 10

[Hamish Willee]

Hi Christoph,
This updates security.mixed_content.upgrade_display_content to build on nightly from FFv84. Does that mean this will also be on by default in all other builds when FFv84 is release? i.e. this feature will no longer be experimental and I can remove this section: https://wiki.developer.mozilla.org/en-US/docs/Mozilla/Firefox/Experimental_features#Upgrading_mixed_display_content

Comment 11

[Hamish Willee]

Christoph, please ignore above. I'm pretty sure has to be as I have indicated.

Docs for this are now in MDN at Web security > Mixed content >Loading mixed-content resources > Upgrading mixed-display resources

There is more information on what was done in https://github.com/mdn/sprints/issues/3906#issuecomment-728664905

Comment 12

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Hamish Willee from comment #11)

Hey Hamish, thanks for reaching out and double checking. To avoid any confusion, the flag security.mixed_content.upgrade_display_content is set to true in Nightly only and will not be on by default in any of our release versions.

FWIW, we have Bug 1672106 on file where we are considering enabling it in release mode - but there are no definite plans to do so just now.

Comment 13

[Hamish Willee]

Christoph, thank you very much. A little work now to undo some of this, but that's what you get for making assumptions.