[Webkit-unassigned] [Bug 62253] New: Do not allow mixed-content WebSockets

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=62253

           Summary: Do not allow mixed-content WebSockets
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: bsmith at mozilla.com


See https://bugzilla.mozilla.org/show_bug.cgi?id=662692

When a script attempts to open a WebSocket to a non-TLS-protected server ("ws://"), the attempt should fail if the document was delivered over HTTPS.

Since there are basically no existing WebSockets servers, there is no compatibility reason to allow ws:// (as opposed to wss://) WebSockets from an https:// webpage. We (Mozilla) would like to move to a stronger policy prohibiting all mixed content, and prohibiting https://+ws:// from the start will help prevent WebSockets from adding to the problem.

In addition to addressing this in code, we should make sure the W3C spec notes this.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.