bramus / bramus/mixed-content-scan
Take `Content-Security-Policy: upgrade-insecure-requests` into account.
- Dominant language
- PHP
- Stars
- 516
- Forks
- 50
- PR merge metrics
- No merged PRs in 30d
Description
> The new `upgrade-insecure-requests` Content Security Policy directive can be used to transparently upgrade insecure resource requests to secure variants. This avoids the mixed content warnings without having to modify the HTML documents at all.
Source: https://dev.opera.com/blog/opera-30/
More details: http://www.w3.org/TR/upgrade-insecure-requests/
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the scanner's existing handling of mixed content, then review the linked W3C upgrade-insecure-requests specification and Opera source. Determine how this directive should affect scan results; done means the scanner accounts for it without reporting content that the policy transparently upgrades.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100