59637 - Give user the choice of seeing insecure content on a secure site

Status: RESOLVED FIXED

(Core Graveyard :: Security: UI, enhancement, P3)

Description

[John Unruh]

1.) With IE5.5, visit the above url, a site with mixed content.
Note the security information dialog box. "This page contains both secure and 
nonsecure items. Do you want to display the nonsecure items?"
There is a yes and no box. Clicking yes displays everything, clicking no leaves 
the insecure frame blank.
I would like to see this feature in Netscape 6.

Comment 1

[nitinp]

changing QA contact to [e-mail]

Comment 2

[David P. Drinan]

Changing product from Browser:Security:Crypto --> PSM 2.0

Comment 3

[Asa Dotzler [:asa]]

why on earth is this marked netscape confidential?

Comment 4

[John Unruh]

No longer confidential

Comment 5

[Bob Lord]

-> Future

Comment 6

[John Unruh]

Mass assigning QA to ckritzer.

Comment 7

[lsof]

This is quite a serious bug. A secure page should not load content from an
insecure page.

Allowing it to without warning is dangerous.

Comment 8

[Kai Engert [:KaiE:]]

As of today, the user is unable to suppress loading of insecure content within a
secure page.
However, at least Mozilla informs the user if it happens.

As the dependency suggests, this bug should be solved together with bug 62178.

Comment 9

[Nelson Bolyard (seldom reads bugmail)]

Mass reassign ddrinan's PSM bugs (with his permission) to nobody

Comment 10

[Nico R.]

Isn’t this bug a duplicate of bug 321022 (or the other way round)? If not, what’s the difference?

By the way, the address in the URL field of this bug doesn’t work anymore.

Comment 11

[Kai Engert [:KaiE:]]

(In reply to comment #10)
> Isn’t this bug a duplicate of bug 321022 (or the other way round)? If not,
> what’s the difference?

I'm trying to explain the difference in bug 321022 comment 19.

Comment 13

[Erlendur S Thorsteinsson]

Bug 321022 (blocking this one) looks fixed in Firefox 23.0.1.

Comment 14

[Daniel Veditz [:dveditz]]

We now block mixed-active content (insecure scripts, etc) on security pages. There's a pref to block mixed-passive content as well (static things like images). When content is blocked a shield icon is shown in the URL bar that allows the user to reload the page including the insecure content.

"Give use the choice of seeing insecure content on a secure site" accomplished.