HTTPS Upgrades

[carlosjoan91]

Request for Mozilla Position on an Emerging Web Specification

• Specification Title: HTTPS Upgrades (as part of fetch).
• Specification or proposal URL (if available): HTTPS Upgrades whatwg/fetch#1654
• Explainer URL (if available): https://github.com/dadrian/https-upgrade/blob/main/explainer.md
• Caniuse.com URL (optional):
• Bugzilla URL (optional):
• Mozillians who can provide input (optional):

Other information

[mozfreddyb]

This looks great. I suggest we mark our position positive given that we are offering a very similar feature in private browsing mode by default.

I'm hoping it will eventually touch on the more hairy issues that we've seen come up with HTTPS-First and it would be great to get better insights into edge cases you all might have seen and how we should deal with them. Some examples are redirect loops, especially using <meta> refreshes or document.location assignments that are not really visible in the networking layer.

[martinthomson]

I agree. @ckerschb might also be able to share some insights into what we learned. Marking this as positive and closing.

Note: while we're supportive, we would like to remind you that this sort of thing needs to move to a standards group. The sooner discussion moves to WHATWG, the better.

[carlosjoan91]

Thanks for the feedback on this. Happy to hear there's interest from Mozilla.

As far as moving this to WHATWG, we previously opened an issue on fetch (whatwg/fetch#1654) since that is where the changes that we are proposing would most likely be implemented. Is there anywhere else on WHATWG you'd suggest bringing this up? Thanks again.