GNOME Bugzilla – Bug 733038
Implement active mixed-content blocking
Last modified: 2015-12-07 12:08:22 UTC
From David Gilmore in bug #726288: "modern browsers should refuse to load active content (javascript) from cleartext channels if they will be running in the context of an authenticated HTTPS origin; epiphany should also refuse to load active content from authentication-failed connections." I agree. All major browsers with the exception of Safari already block active mixed content. They also have UI for overriding this on a per-site basis, so I guess Epiphany should have that too. Firefox and Chrome both use shield icons in the address bar, and clicking on the shield allows the user to load the unsafe content. I think Internet Explorer has been blocking even passive mixed content for a long time now (several years), but I don't suggest this as neither Firefox nor Chrome do and it's still very common. This is similar to bug #666808, but more strict: bug #666808 is for implementing mixed content *detection* for all mixed content, which is already supported by WebKitGTK+, whereas this bug is about preventing active mixed content from ever running. Quick testcase: https://www.ssllabs.com/ssltest/viewMyClient.html
It's "Daniel Gillmor", not "David Gilmore" :) Thanks for breaking this out as a distinct issue, Michael!
Whoops! Partial credit for the first two letters right? I'm planning to propose new API in WebKitGTK+ to facilitate this. I think the plumbing already exists, though it was only ever used by the Chromium port.
Created attachment 281603 [details] :) It will take a little while for me to get the required changes merged into WebKit, but it's coming....
See also http://w3c.github.io/webappsec/specs/mixedcontent/
Created attachment 294287 [details] [review] Prohibit deletion of promotion type dialog This works, but the downside is that I bet some window managers will show a close button even though mutter doesn't. And it's hacky, but I couldn't figure out any better way to intercept deletion with the Escape key.
Comment on attachment 294287 [details] [review] Prohibit deletion of promotion type dialog Yup wrong bug.
Fixed in WebKit