Content from loopback addresses (e.g. 127.0.0.1) should not be considered mixed content
In progress Issue #11963735 • Assigned to Rajat J.
Details
- Author
- Birunthan M.
- Created
- May 10, 2017
- Privacy
- This issue is public.
- Found in
- Standard affected
- Secure Contexts
- Reports
- Reported by 1 person
Sign in to watch or report this issue.
Steps to reproduce
According to the spec, content from loopback addresses should no longer
be treated as mixed content even in secure origins. See:
- https://github.com/w3c/webappsec-mixed-content/commit/349501cdaa4b4dc1e2a8aacb216ced58fd316165
- https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy
In other words, e.g. fetch('http://127.0.0.1:1234/foo/bar') on a HTTPS site should be allowed without triggering the mixed content blocker.
Note Chrome (and soon Firefox) only whitelist ‘127.0.0.1’ and '::1’. See:
Comments and activity
-
Changed Steps to Reproduce
-
Microsoft Edge Team Changed Assigned To to “Steven K.”
Changed Assigned To to “Venkat K.”
Changed Assigned To from “Venkat K.” to “Ali A.”
Changed Assigned To from “Ali A.” to “Rajat J.”
Changed Status to “Confirmed”
Changed Status from “Confirmed” to “In progress”
You need to sign in to your Microsoft account to add a comment.
Sign in