[Webkit-unassigned] [Bug 29754] Replace FrameLoadDelegate mixed content warning SPI with a single one

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=29754





--- Comment #3 from Adam Barth <abarth at webkit.org>  2009-09-26 17:48:28 PDT ---
(In reply to comment #2)
> Interesting.  Can you elaborate briefly on this?

Sure.  Suppose we have two tabs open to the same HTTPS site.  In one tab, the
user approves a certificate error and receives HTML over a broken certificate. 
Now, we need to remove the lock icon from the other tag because the attacker
can inject script into the first tab.

Similarly, suppose the user approves a certificate error for https://foo.com. 
Now, later, https://bar.com includes a <script src="https://foo.com/ttt"> and
the browser loads the script over a broken HTTPS connection.  Now, we need to
remove the lock icon from that https://bar.com tab as well as all the others.

It's possible the best thing to do is teach WebCore about certificate errors. 
That way, we can ask the WebKitClient whether to approve the bad certificate
(instead of doing it via the back door in the network stack).  If we do that,
we can manage the cert error state and the mixed content state together in
WebCore.

> Perhaps we should document
> what the app is expected to do with these delegate methods a little better.

I can write up a short white paper about how all this stuff ought to work if
that would be helpful.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.