A Web page is called mixed content if the top-level resource was retrieved through a strongly TLS protected HTTP transaction, but some dependent resources were retrieved through a weakly protected or unprotected HTTP transaction.
Web Security Context: User Interface Guidelines ( 版) http://www.w3.org/TR/2010/REC-wsc-ui-20100812/#def-mixed-content[93] この旧定義は Mixed Content
により更新されました >>90。
[6] Web Security Context: User Interface Guidelines
( ( 版))
http://www.w3.org/TR/wsc-ui/#def-mixed-content
[12] Clarify MIX and CSP hooks a bit · 682f68d · whatwg/fetch
( ( 版))
https://github.com/whatwg/fetch/commit/682f68d5f0cce7f9637a8f6d9450b514ed276f9b
[13] Put MIX/CSP hooks in switch. Put second MIX check before tainting. · 567fe8a · whatwg/fetch
( ( 版))
https://github.com/whatwg/fetch/commit/567fe8ad5f1804efdefa7aa273f2a366b223c70e
[17] MIX: Walk the ancestor tree for powerful features. · 8d8d201 · w3c/webappsec
( ( 版))
https://github.com/w3c/webappsec/commit/8d8d201a571896267b229e9be0bd5cab222d67a2
[18] Fix the order of CSP, HSTS, Mixed Content, and Referrer https://www.w3.o... · b8c2c49 · whatwg/fetch
( 版)
https://github.com/whatwg/fetch/commit/b8c2c4964c233cd3616042c04e2c14e0ff25485d
[22] Re: [MIX] Modifications to script APIs
(Anne van Kesteren 著, 版)
https://lists.w3.org/Archives/Public/public-webappsec/2014Oct/0228.html
[23] Bug 28577 – [XMLHttpRequest] Throwing SecurityError on open() call for some kind of simple errors
( 版)
https://www.w3.org/Bugs/Public/show_bug.cgi?id=28577
[24] HTML Standard
( 版)
https://html.spec.whatwg.org/#dom-websocket
If secure is false but the origin specified by the entry settings object has a scheme component that is itself a secure protocol, e.g. HTTPS, then throw a SecurityError exception and abort these steps.
[29] MIX: Cite a source for the IE4 note. · w3c/webappsec@9b1690c
( 版)
https://github.com/w3c/webappsec/commit/9b1690c0432e0320fa861c89ced452bbaf45a5ed
[30] PRB: Security Warning Message Occurs When You Browse to a Page That Contains an IFRAME Through SSL
( 版)
https://support2.microsoft.com/default.aspx?scid=kb;EN-US;Q261188
[31] Eric Lawrence on Twitter: "@mikewest IE6-IE8 used a modal dialog box. http://t.co/fvK7RiZ9Pi implies that IE4/IE5 had the same. Sadly, I don't have any Win9x VMs."
( 版)
https://twitter.com/ericlaw/status/469813922908758016
"Mixed security context" loads happen when a web application
resource, fetched by the UA over a secure transport, subsequently
causes the fetching of one or more other resources without using
secure transport. This is also generally referred to as "mixed
content" loads (see Section 5.3 ("Mixed Content") in
[W3C.REC-wsc-ui-20100812]) but should not be confused with the same
"mixed content" term that is also used in the context of markup
languages such as XML and HTML.
NOTE: In order to provide behavioral uniformity across UA
implementations, the notion of mixed security context will
require further standardization work, e.g., to define the
term(s) more clearly and to define specific behaviors with
respect to it.
[34] Re: CSP2: Drop 'unsafe-redirect'.
(Brian Smith 著, 版)
https://lists.w3.org/Archives/Public/public-webappsec/2015Jul/0019.html
When Firefox implemented mixed content blocking, Mozilla treated
Mozilla-owned sites specially: We assumed that our coworkers would make the
necessary changes before we shipped, after we helped them understand what
was necessary, and so we didn't consider breaking any Mozilla site a risk
for shipping. That strategy worked very well for us (IIRC).
[35] Intent to Ship: Strict mixed content checking. - Google Groups
( 版)
https://groups.google.com/a/chromium.org/d/msg/blink-dev/MafYMJ3zQw0/DkZdADnS3hMJ
[36] MIX: First stab at SW integration. · w3c/webappsec@e577d4d
( 版)
https://github.com/w3c/webappsec/commit/e577d4d5746bd33248a7dd4dbe0db515c16f20fb
[37] MIX: Dropping the irrelevant CORS mode check from passthrough requests. · w3c/webappsec@72c2dba
( 版)
https://github.com/w3c/webappsec/commit/72c2dba9b871a577c2be24101d57f71b63240974
[50] Use 'Is URL trustworthy?' rather than whitelisting 'https' and 'wss'.
(mikewest著, )
https://github.com/w3c/webappsec-mixed-content/commit/349501cdaa4b4dc1e2a8aacb216ced58fd316165
[51] CfC: Republish "Mixed Content" as CR; deadline July 27th.
(Mike West著, )
https://lists.w3.org/Archives/Public/public-webappsec/2016Jul/0033.html