Code: Select all
<head>
<base href="http://www.example.com/"></base>
<script type="text/javascript" src="a.js"></script>
<script type="text/javascript" src="http://www.example.com/b.js"></script>
</head>
Unfortunately, both HSTS and NoScript perform the redirection after content policies have been checked.dhouwn wrote:Does it make a difference whether Firefox itself (because of HSTS) or NoScript does the redirection?
OK, thanks for the explanation.Giorgio Maone wrote:Unfortunately, both HSTS and NoScript perform the redirection after content policies have been checked.
) I don't believe it would. This HTTP upgrade mechanism is mainly meant to make web sockets work, and the latter would be an issue only if you want to allow HTTP content and forbid HTTPS content on the same domain, something which frankly looks very unlikely. And anyway, if it ends to be an issue, we can ask to have a content policy hook on protocol change (even though I believe this will be implemented with redirection semantic, and therefore will be intercepted by NoScript anyway).dhouwn wrote: would this be an issue now that HTTP Upgrade is possible (which from what I understand makes it possible to change from http to another protocol type on-the-fly and might play a role for blockable page content if RFC 2817 gets implemented)?)