canmove, Confirmed users
285
edits
Security/Features/Mixed Content Blocker: Difference between revisions
Jump to navigation
Jump to search
Security/Features/Mixed Content Blocker (view source)
Revision as of 00:07, 9 April 2013
, 9 April 2013no edit summary
No edit summary |
No edit summary |
||
| Line 17: | Line 17: | ||
}} | }} | ||
{{FeaturePageBody | {{FeaturePageBody | ||
|Feature open issues and risks== UI tweaks = | |Feature open issues and risks==== UI tweaks === | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=834828 - Make mixed content blocker more discoverable | * https://bugzilla.mozilla.org/show_bug.cgi?id=834828 - Make mixed content blocker more discoverable | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=834830 - Strike through https | * https://bugzilla.mozilla.org/show_bug.cgi?id=834830 - Strike through https | ||
| Line 24: | Line 24: | ||
* v2 Technical Information section that shows what is blocked. | * v2 Technical Information section that shows what is blocked. | ||
= Bugs related to Developer and User Information = | === Bugs related to Developer and User Information === | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=837351 - Webconsole + Error Console alerts when Mixed Content is Blocked | * https://bugzilla.mozilla.org/show_bug.cgi?id=837351 - Webconsole + Error Console alerts when Mixed Content is Blocked | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=781018 - Telemetry | * https://bugzilla.mozilla.org/show_bug.cgi?id=781018 - Telemetry | ||
| Line 31: | Line 31: | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=836431 - Distinguish between mixed active vs mixed display loads in Webconsole - https://developer.mozilla.org/en-US/docs/Security/MixedContent | * https://bugzilla.mozilla.org/show_bug.cgi?id=836431 - Distinguish between mixed active vs mixed display loads in Webconsole - https://developer.mozilla.org/en-US/docs/Security/MixedContent | ||
= Edge Cases = | === Edge Cases === | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=418354, https://bugzilla.mozilla.org/show_bug.cgi?id=456957 - Redirects | * https://bugzilla.mozilla.org/show_bug.cgi?id=418354, https://bugzilla.mozilla.org/show_bug.cgi?id=456957 - Redirects | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=815345 - Session Restore and document.write | * https://bugzilla.mozilla.org/show_bug.cgi?id=815345 - Session Restore and document.write | ||
| Line 37: | Line 37: | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=838395 - Relying on HSTS to prevent Mixed Content | * https://bugzilla.mozilla.org/show_bug.cgi?id=838395 - Relying on HSTS to prevent Mixed Content | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=826599 - Mixed content in iframes. | * https://bugzilla.mozilla.org/show_bug.cgi?id=826599 - Mixed content in iframes. | ||
|Feature overview=The Mixed Content Blocker prevents "mixed script" content, defined as mixed content loads of scripts, plugins, and stylesheets, from being loaded into a secure web page. The primary threat model is the active network attacker who modifies the contents of mixed script resources to compromise the integrity of a secure web application. This feature blocks mixed scripts from loading by default, and adds UI that enables a user to reload the page with the insecure content permitted to load. | |Feature overview=The Mixed Content Blocker prevents "mixed script" content, defined as mixed content loads of scripts, plugins, and stylesheets, from being loaded into a secure web page. The primary threat model is the active network attacker who modifies the contents of mixed script resources to compromise the integrity of a secure web application. This feature blocks mixed scripts from loading by default, and adds UI that enables a user to reload the page with the insecure content permitted to load. | ||
|Feature non-goals=To prevent the disclosure of cookies and other sensitive data through mixed display content, such as images, and video. We have a pref, disabled by default, which when enabled would block these loads as well using the same infrastructure. | |Feature non-goals=To prevent the disclosure of cookies and other sensitive data through mixed display content, such as images, and video. We have a pref, disabled by default, which when enabled would block these loads as well using the same infrastructure. | ||