918237 - Enhance Mixed Content error messages for case: HTTP top level; HTTPS iframe; HTTP insecure load

Status: NEW

(Firefox :: Security, defect)

Description

[Gervase Markham [:gerv]]

If the top-level page is HTTP, there's an HTTPS iframe and that iframe makes an HTTP insecure load, the error looks like this:

[15:50:14.853] Blocked loading mixed active content
"http://www.sainsburys.co.uk/groceries/trolley/trolley_detail_amend.jsp?bmUID=1379343014692"
@ http://www.sainsburys.co.uk/groceries/index.jsp?bmUID=1379343011623

Note that both URLs are "http". This is deeply confusing as a "mixed content blocking" error message :-) We should enhance the error to contain the full URL stack from top level down to the insecure load.

Gerv