bramus / bramus/mixed-content-scan

Take `Content-Security-Policy: upgrade-insecure-requests` into account.

Open
#25 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
516
Forks
50
PR merge metrics
No merged PRs in 30d

Description

> The new `upgrade-insecure-requests` Content Security Policy directive can be used to transparently upgrade insecure resource requests to secure variants. This avoids the mixed content warnings without having to modify the HTML documents at all.

Source: https://dev.opera.com/blog/opera-30/
More details: http://www.w3.org/TR/upgrade-insecure-requests/

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the scanner's existing handling of mixed content, then review the linked W3C upgrade-insecure-requests specification and Opera source. Determine how this directive should affect scan results; done means the scanner accounts for it without reporting content that the policy transparently upgrades.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.