{"action":"created","comment":{"url":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/comments/29863009","id":29863009,"diff_hunk":"@@ -0,0 +1,102 @@\n+# Upgrade Insecure Requests Draft Feedback\n+\n+[Draft under discussion.](https://w3c.github.io/webappsec/specs/upgrade/) ([At this revision](https://github.com/w3c/webappsec/tree/f3ef3fb43394d57fa3ff9f93f22f3b057f7551be/specs/upgrade))\n+\n+## General Discussion\n+\n+This draft defines a new Content Security Policy header for a page to assert\n+that subresources should be automatically upgraded to their secure version. We\n+think this is a great step towards reducing barriers that website publishers\n+face when transitioning from plaintext HTTP to secure connections.\n+\n+### ISSUE: Goal 1 Unclear\n+\n+Section 1.1, Goal 1:\n+\n+> Authors should be able to ensure that all content requested by a given page\n+> loads successfully, and securely. Mixed content blocking should not break\n+> pages as a result of migrating to a secure origin.\n+\n+This seems somewhat too ambitious for the spec. If third-party content on\n+a page does not support HTTPS or stops supporting HTTPS, the page author cannot\n+ensure that the content is loaded securely or at all. Inevitably, moving to\n+a secure origin causes problems with mixed content blocking if the page has\n+third party content that doesn't yet support HTTPS, a problem which the spec\n+does not address.\n+\n+### ISSUE: Same-Origin vs Cross-Origin Behavior Unclear in Examples\n+\n+Talking to other TAG members about the spec, it became apparent that some of us\n+thought the spec only applied upgrades to same-origin requests. I attribute\n+most of my confusion to the examples in Section 1.2. Example #1 uses the\n+example of `<img src=\"http://example.com/image.png\">` being upgraded on\n+`https://example.com` and Example #2 explicitly says that `<a\n+href=\"http://not-example.com/\">Home</a>` will *not* be upgraded on\n+`https://example.com`. It would be better if Example #1 explicitly said that\n+a third-party origin like `not-example.com` is upgradeable in that context, so\n+that readers don't generalize Example #2 to all requests.\n+\n+### CLARIFICATION: Wording in Terminology\n+\n+The wording \"depend on the upgrade-insecure-requests mechanism\" in Section 2 is\n+unclear. It seems to mean something like, \"the same with and without\n+upgrade-insecure-requests\" from context, but I'm not sure.\n+\n+### COMMENT: +1 for Issue #184\n+\n+https://github.com/w3c/webappsec/issues/184 seems like a good thing for\n+improving the smoothness of the HTTP to HTTPS transition.\n+\n+### ISSUE: Need Example for Upgrade Insecure Navigations Set\n+\n+It would be nice to have an example of a CSP directive with an upgrade insecure\n+navigations set in the draft.\n+\n+### ISSUE: Upgrade All Navigations\n+\n+Is there a way to specify that all navigations should be upgraded? That seems\n+useful if a webmaster doesn't want to change their header every time they add\n+a link and are confident all their links will support HTTPS.\n+\n+### ISSUE: Inconsistent Wording in 4.1?\n+\n+Section 4.1:\n+> We will not upgrade cross-origin navigational requests, with the exception of\n+> form submissions\n+\n+I'm confused now because the document otherwise states that cross-origin\n+navigational requests will be upgraded if they are in the \"upgrade insecure\n+navigations set\" for a context.\n+\n+### CLARIFICATION: Violation Reports for Inherited Policy\n+\n+As mentioned in 6.2, there is a security issue if a document is able to get\n+violation reports for cross-origin nested documents (iframes, etc.) which\n+inherit upgrade policy. So if a nested document does not specify its reporting\n+endpoint, do all reports from the nested document get blocked?\n+\n+### IDEA: Cache/Pin Successful Upgrades\n+\n+Thinking about the broader goal of encrypting the web, it would be nice if\n+user agents could remember which subresources have been successfully upgraded\n+through this mechanism. That way, on a page that has not set the CSP header,\n+the known-upgradeable subresources could be upgraded anyway.\n+\n+### IDEA: Allow Sites to Signal That They Are Upgradeable Resources\n+\n+One downside of fetch (and Firefox/Chrome's implementation of mixed content\n+blocking) is that HSTS is applied after mixed content blocking has happened. So\n+sites that are known to support HTTPS are *still* blocked.\n+\n+This spec allows a site to indicate that its subresouces should be upgraded.\n+However, there is still no way for a site to say, \"Upgrade me when I am\n+a subresource, because I know I support HTTPS.\"\n+\n+## End Notes\n+\n+This draft is a very welcome move towards better handling of mixed content\n+blocking. However, in its current form, it entirely depends on the *embedding*\n+site setting the CSP header. We would like to see ways for the *embedded* sites","path":"2015/04/Upgrade_Insecure.md","position":99,"original_position":99,"commit_id":"bad191c89e0231c54580fa90e314ef0fbc3b2898","original_commit_id":"bad191c89e0231c54580fa90e314ef0fbc3b2898","user":{"login":"annevk","id":1544111,"avatar_url":"https://avatars.githubusercontent.com/u/1544111?v=3","gravatar_id":"","url":"https://api.github.com/users/annevk","html_url":"https://github.com/annevk","followers_url":"https://api.github.com/users/annevk/followers","following_url":"https://api.github.com/users/annevk/following{/other_user}","gists_url":"https://api.github.com/users/annevk/gists{/gist_id}","starred_url":"https://api.github.com/users/annevk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/annevk/subscriptions","organizations_url":"https://api.github.com/users/annevk/orgs","repos_url":"https://api.github.com/users/annevk/repos","events_url":"https://api.github.com/users/annevk/events{/privacy}","received_events_url":"https://api.github.com/users/annevk/received_events","type":"User","site_admin":false},"body":"Right. The non-determinism is why Chrome and Firefox won't do this.","created_at":"2015-05-07T15:26:38Z","updated_at":"2015-05-07T15:26:38Z","html_url":"https://github.com/w3ctag/spec-reviews/pull/54#discussion_r29863009","pull_request_url":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54","_links":{"self":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/comments/29863009"},"html":{"href":"https://github.com/w3ctag/spec-reviews/pull/54#discussion_r29863009"},"pull_request":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54"}}},"pull_request":{"url":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54","id":34004237,"html_url":"https://github.com/w3ctag/spec-reviews/pull/54","diff_url":"https://github.com/w3ctag/spec-reviews/pull/54.diff","patch_url":"https://github.com/w3ctag/spec-reviews/pull/54.patch","issue_url":"https://api.github.com/repos/w3ctag/spec-reviews/issues/54","number":54,"state":"open","locked":false,"title":"Strawman spec review for upgrade insecure requests","user":{"login":"diracdeltas","id":549654,"avatar_url":"https://avatars.githubusercontent.com/u/549654?v=3","gravatar_id":"","url":"https://api.github.com/users/diracdeltas","html_url":"https://github.com/diracdeltas","followers_url":"https://api.github.com/users/diracdeltas/followers","following_url":"https://api.github.com/users/diracdeltas/following{/other_user}","gists_url":"https://api.github.com/users/diracdeltas/gists{/gist_id}","starred_url":"https://api.github.com/users/diracdeltas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diracdeltas/subscriptions","organizations_url":"https://api.github.com/users/diracdeltas/orgs","repos_url":"https://api.github.com/users/diracdeltas/repos","events_url":"https://api.github.com/users/diracdeltas/events{/privacy}","received_events_url":"https://api.github.com/users/diracdeltas/received_events","type":"User","site_admin":false},"body":"Address #50 \r\n\r\ncc @timbl @mnot etc.","created_at":"2015-04-23T22:43:47Z","updated_at":"2015-05-07T15:26:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"71884d2beff117341e2ae133e4fd92295e50f4e4","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54/commits","review_comments_url":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54/comments","review_comment_url":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/comments{/number}","comments_url":"https://api.github.com/repos/w3ctag/spec-reviews/issues/54/comments","statuses_url":"https://api.github.com/repos/w3ctag/spec-reviews/statuses/bad191c89e0231c54580fa90e314ef0fbc3b2898","head":{"label":"diracdeltas:upgrade-insecure","ref":"upgrade-insecure","sha":"bad191c89e0231c54580fa90e314ef0fbc3b2898","user":{"login":"diracdeltas","id":549654,"avatar_url":"https://avatars.githubusercontent.com/u/549654?v=3","gravatar_id":"","url":"https://api.github.com/users/diracdeltas","html_url":"https://github.com/diracdeltas","followers_url":"https://api.github.com/users/diracdeltas/followers","following_url":"https://api.github.com/users/diracdeltas/following{/other_user}","gists_url":"https://api.github.com/users/diracdeltas/gists{/gist_id}","starred_url":"https://api.github.com/users/diracdeltas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diracdeltas/subscriptions","organizations_url":"https://api.github.com/users/diracdeltas/orgs","repos_url":"https://api.github.com/users/diracdeltas/repos","events_url":"https://api.github.com/users/diracdeltas/events{/privacy}","received_events_url":"https://api.github.com/users/diracdeltas/received_events","type":"User","site_admin":false},"repo":{"id":31735411,"name":"spec-reviews","full_name":"diracdeltas/spec-reviews","owner":{"login":"diracdeltas","id":549654,"avatar_url":"https://avatars.githubusercontent.com/u/549654?v=3","gravatar_id":"","url":"https://api.github.com/users/diracdeltas","html_url":"https://github.com/diracdeltas","followers_url":"https://api.github.com/users/diracdeltas/followers","following_url":"https://api.github.com/users/diracdeltas/following{/other_user}","gists_url":"https://api.github.com/users/diracdeltas/gists{/gist_id}","starred_url":"https://api.github.com/users/diracdeltas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diracdeltas/subscriptions","organizations_url":"https://api.github.com/users/diracdeltas/orgs","repos_url":"https://api.github.com/users/diracdeltas/repos","events_url":"https://api.github.com/users/diracdeltas/events{/privacy}","received_events_url":"https://api.github.com/users/diracdeltas/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/diracdeltas/spec-reviews","description":"W3C specs and API reviews ","fork":true,"url":"https://api.github.com/repos/diracdeltas/spec-reviews","forks_url":"https://api.github.com/repos/diracdeltas/spec-reviews/forks","keys_url":"https://api.github.com/repos/diracdeltas/spec-reviews/keys{/key_id}","collaborators_url":"https://api.github.com/repos/diracdeltas/spec-reviews/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/diracdeltas/spec-reviews/teams","hooks_url":"https://api.github.com/repos/diracdeltas/spec-reviews/hooks","issue_events_url":"https://api.github.com/repos/diracdeltas/spec-reviews/issues/events{/number}","events_url":"https://api.github.com/repos/diracdeltas/spec-reviews/events","assignees_url":"https://api.github.com/repos/diracdeltas/spec-reviews/assignees{/user}","branches_url":"https://api.github.com/repos/diracdeltas/spec-reviews/branches{/branch}","tags_url":"https://api.github.com/repos/diracdeltas/spec-reviews/tags","blobs_url":"https://api.github.com/repos/diracdeltas/spec-reviews/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/diracdeltas/spec-reviews/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/diracdeltas/spec-reviews/git/refs{/sha}","trees_url":"https://api.github.com/repos/diracdeltas/spec-reviews/git/trees{/sha}","statuses_url":"https://api.github.com/repos/diracdeltas/spec-reviews/statuses/{sha}","languages_url":"https://api.github.com/repos/diracdeltas/spec-reviews/languages","stargazers_url":"https://api.github.com/repos/diracdeltas/spec-reviews/stargazers","contributors_url":"https://api.github.com/repos/diracdeltas/spec-reviews/contributors","subscribers_url":"https://api.github.com/repos/diracdeltas/spec-reviews/subscribers","subscription_url":"https://api.github.com/repos/diracdeltas/spec-reviews/subscription","commits_url":"https://api.github.com/repos/diracdeltas/spec-reviews/commits{/sha}","git_commits_url":"https://api.github.com/repos/diracdeltas/spec-reviews/git/commits{/sha}","comments_url":"https://api.github.com/repos/diracdeltas/spec-reviews/comments{/number}","issue_comment_url":"https://api.github.com/repos/diracdeltas/spec-reviews/issues/comments{/number}","contents_url":"https://api.github.com/repos/diracdeltas/spec-reviews/contents/{+path}","compare_url":"https://api.github.com/repos/diracdeltas/spec-reviews/compare/{base}...{head}","merges_url":"https://api.github.com/repos/diracdeltas/spec-reviews/merges","archive_url":"https://api.github.com/repos/diracdeltas/spec-reviews/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/diracdeltas/spec-reviews/downloads","issues_url":"https://api.github.com/repos/diracdeltas/spec-reviews/issues{/number}","pulls_url":"https://api.github.com/repos/diracdeltas/spec-reviews/pulls{/number}","milestones_url":"https://api.github.com/repos/diracdeltas/spec-reviews/milestones{/number}","notifications_url":"https://api.github.com/repos/diracdeltas/spec-reviews/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/diracdeltas/spec-reviews/labels{/name}","releases_url":"https://api.github.com/repos/diracdeltas/spec-reviews/releases{/id}","created_at":"2015-03-05T20:45:54Z","updated_at":"2015-03-05T20:45:54Z","pushed_at":"2015-04-23T22:42:14Z","git_url":"git://github.com/diracdeltas/spec-reviews.git","ssh_url":"git@github.com:diracdeltas/spec-reviews.git","clone_url":"https://github.com/diracdeltas/spec-reviews.git","svn_url":"https://github.com/diracdeltas/spec-reviews","homepage":null,"size":186,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"w3ctag:master","ref":"master","sha":"903e56f9737435c8198284b5f61b73f8198a0fb0","user":{"login":"w3ctag","id":3874462,"avatar_url":"https://avatars.githubusercontent.com/u/3874462?v=3","gravatar_id":"","url":"https://api.github.com/users/w3ctag","html_url":"https://github.com/w3ctag","followers_url":"https://api.github.com/users/w3ctag/followers","following_url":"https://api.github.com/users/w3ctag/following{/other_user}","gists_url":"https://api.github.com/users/w3ctag/gists{/gist_id}","starred_url":"https://api.github.com/users/w3ctag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/w3ctag/subscriptions","organizations_url":"https://api.github.com/users/w3ctag/orgs","repos_url":"https://api.github.com/users/w3ctag/repos","events_url":"https://api.github.com/users/w3ctag/events{/privacy}","received_events_url":"https://api.github.com/users/w3ctag/received_events","type":"Organization","site_admin":false},"repo":{"id":11005977,"name":"spec-reviews","full_name":"w3ctag/spec-reviews","owner":{"login":"w3ctag","id":3874462,"avatar_url":"https://avatars.githubusercontent.com/u/3874462?v=3","gravatar_id":"","url":"https://api.github.com/users/w3ctag","html_url":"https://github.com/w3ctag","followers_url":"https://api.github.com/users/w3ctag/followers","following_url":"https://api.github.com/users/w3ctag/following{/other_user}","gists_url":"https://api.github.com/users/w3ctag/gists{/gist_id}","starred_url":"https://api.github.com/users/w3ctag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/w3ctag/subscriptions","organizations_url":"https://api.github.com/users/w3ctag/orgs","repos_url":"https://api.github.com/users/w3ctag/repos","events_url":"https://api.github.com/users/w3ctag/events{/privacy}","received_events_url":"https://api.github.com/users/w3ctag/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/w3ctag/spec-reviews","description":"W3C specs and API reviews ","fork":false,"url":"https://api.github.com/repos/w3ctag/spec-reviews","forks_url":"https://api.github.com/repos/w3ctag/spec-reviews/forks","keys_url":"https://api.github.com/repos/w3ctag/spec-reviews/keys{/key_id}","collaborators_url":"https://api.github.com/repos/w3ctag/spec-reviews/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/w3ctag/spec-reviews/teams","hooks_url":"https://api.github.com/repos/w3ctag/spec-reviews/hooks","issue_events_url":"https://api.github.com/repos/w3ctag/spec-reviews/issues/events{/number}","events_url":"https://api.github.com/repos/w3ctag/spec-reviews/events","assignees_url":"https://api.github.com/repos/w3ctag/spec-reviews/assignees{/user}","branches_url":"https://api.github.com/repos/w3ctag/spec-reviews/branches{/branch}","tags_url":"https://api.github.com/repos/w3ctag/spec-reviews/tags","blobs_url":"https://api.github.com/repos/w3ctag/spec-reviews/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/w3ctag/spec-reviews/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/w3ctag/spec-reviews/git/refs{/sha}","trees_url":"https://api.github.com/repos/w3ctag/spec-reviews/git/trees{/sha}","statuses_url":"https://api.github.com/repos/w3ctag/spec-reviews/statuses/{sha}","languages_url":"https://api.github.com/repos/w3ctag/spec-reviews/languages","stargazers_url":"https://api.github.com/repos/w3ctag/spec-reviews/stargazers","contributors_url":"https://api.github.com/repos/w3ctag/spec-reviews/contributors","subscribers_url":"https://api.github.com/repos/w3ctag/spec-reviews/subscribers","subscription_url":"https://api.github.com/repos/w3ctag/spec-reviews/subscription","commits_url":"https://api.github.com/repos/w3ctag/spec-reviews/commits{/sha}","git_commits_url":"https://api.github.com/repos/w3ctag/spec-reviews/git/commits{/sha}","comments_url":"https://api.github.com/repos/w3ctag/spec-reviews/comments{/number}","issue_comment_url":"https://api.github.com/repos/w3ctag/spec-reviews/issues/comments{/number}","contents_url":"https://api.github.com/repos/w3ctag/spec-reviews/contents/{+path}","compare_url":"https://api.github.com/repos/w3ctag/spec-reviews/compare/{base}...{head}","merges_url":"https://api.github.com/repos/w3ctag/spec-reviews/merges","archive_url":"https://api.github.com/repos/w3ctag/spec-reviews/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/w3ctag/spec-reviews/downloads","issues_url":"https://api.github.com/repos/w3ctag/spec-reviews/issues{/number}","pulls_url":"https://api.github.com/repos/w3ctag/spec-reviews/pulls{/number}","milestones_url":"https://api.github.com/repos/w3ctag/spec-reviews/milestones{/number}","notifications_url":"https://api.github.com/repos/w3ctag/spec-reviews/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/w3ctag/spec-reviews/labels{/name}","releases_url":"https://api.github.com/repos/w3ctag/spec-reviews/releases{/id}","created_at":"2013-06-27T19:37:14Z","updated_at":"2015-04-20T22:40:13Z","pushed_at":"2015-04-23T22:43:47Z","git_url":"git://github.com/w3ctag/spec-reviews.git","ssh_url":"git@github.com:w3ctag/spec-reviews.git","clone_url":"https://github.com/w3ctag/spec-reviews.git","svn_url":"https://github.com/w3ctag/spec-reviews","homepage":null,"size":566,"stargazers_count":16,"watchers_count":16,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":10,"mirror_url":null,"open_issues_count":20,"forks":10,"open_issues":20,"watchers":16,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54"},"html":{"href":"https://github.com/w3ctag/spec-reviews/pull/54"},"issue":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/issues/54"},"comments":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/issues/54/comments"},"review_comments":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54/comments"},"review_comment":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/pulls/54/commits"},"statuses":{"href":"https://api.github.com/repos/w3ctag/spec-reviews/statuses/bad191c89e0231c54580fa90e314ef0fbc3b2898"}}}}