Forbid active web content unless…

[dhouwn]

…it comes from a secure (HTTPS) connection

I guess encrypted websockets and SPDY connections also are also "secure connections" and are also accepted, so maybe this should be clarified.

[GµårÐïåñ]

It may be because I haven't slept in 4+ days and been poked and prodded more than a pin cushion, but I am not getting the issue you are presenting, can you break it down for me a bit?

[Giorgio Maone]

…it comes from a secure (HTTPS) connection

I guess encrypted websockets and SPDY connections also are also "secure connections" and are also accepted, so maybe this should be clarified.

WebSockets aren't used to serve active content, but just data.
SPDY is transparent to the user, who keeps seeing it as HTTPS (unless he uses a packat sniffer).

[GµårÐïåñ]

After 2 hours of "sleep" and Giorgio's response, I get it now