We encourage authors to transition their sites and applications away from insecure transport, and onto encrypted and authenticated connections, but mixed content checking causes headaches. This feature allows authors to ask the user agent to transparently upgrade HTTP resources to HTTPS to ease the migration burden.

Demo

• https://github.com/GoogleChrome/samples/tree/gh-pages/csp-upgrade-insecure-requests

Documentation

• https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives#upgrade-insecure-requests

Specification

Specification link

Status: Specification currently under development in a Working Group

Status in Chromium

Blink components: Blink

Implementation status: Enabled by default (tracking bug)

Consensus & Standardization

• Firefox: Shipped/Shipping
• Edge: In development
• Safari: Shipped/Shipping
• Web Developers: Positive

Owner

• mkwst@chromium.org

Last updated on 2020-11-09