| commit | 92725553228681b9b7a8fd9a9e9f324d32c12018 | |
| author | lgarron <lgarron@chromium.org> | |
| Tue, 12 May 2015 02:03:15 +0000 (11 19:03 -0700) | ||
| committer | Commit bot <commit-bot@chromium.org> | |
| Tue, 12 May 2015 02:03:55 +0000 (12 02:03 +0000) | ||
| tree | 264c4feedbd92773e3a68599425c836ea50b6cc3 | treesnapshot (tar.gz zip) |
| parent | 6a9b5b10ff3515adb47718fc23ebe039a9e3b9ff | commitdiff |
Switch remaining functions from SchemeIsSecure() to
SchemeIsCryptographic().
We recently introduced SchemeIsCryptographic() and IsOriginSecure(),
which are meant to replace SchemeIsSecure().
IsOriginSecure() roughly means "do we trust this content not to be
tampered with before it reaches the user?" [1] This is a higher-level
definition that corresponds to the new "privileged contexts" spec. [2]
SchemeIsCryptographic() [3] is close to the old definition of
SchemeIsSecure(), and literally just checks if the scheme is a
cryptographic scheme (HTTPS or WSS as of right now). The difference is
that SchemeIsCryptographic() will not consider filesystem URLs secure.
IsOriginSecure() should be correct for most Fizz code.
[1] https://code.google.com/p/chromium/codesearch#chromium/src/content/public/common/origin_util.h&sq=package:chromium&type=cs&l=19&rcl=143099866
[2] https://www.chromium.org/Home/chromium-security/prefer-secure-origins-for-powerful-new-features and https://w3c.github.io/webappsec/specs/powerfulfeatures/
[3] https://code.google.com/p/chromium/codesearch#chromium/src/url/gurl.h&sq=package:chromium&type=cs&l=250&rcl=1430998666
BUG=362214
Review URL: https://codereview.chromium.org/1136643004
Cr-Commit-Position: refs/heads/master@{#329310}
SchemeIsCryptographic().
We recently introduced SchemeIsCryptographic() and IsOriginSecure(),
which are meant to replace SchemeIsSecure().
IsOriginSecure() roughly means "do we trust this content not to be
tampered with before it reaches the user?" [1] This is a higher-level
definition that corresponds to the new "privileged contexts" spec. [2]
SchemeIsCryptographic() [3] is close to the old definition of
SchemeIsSecure(), and literally just checks if the scheme is a
cryptographic scheme (HTTPS or WSS as of right now). The difference is
that SchemeIsCryptographic() will not consider filesystem URLs secure.
IsOriginSecure() should be correct for most Fizz code.
[1] https://code.google.com/p/chromium/codesearch#chromium/src/content/public/common/origin_util.h&sq=package:chromium&type=cs&l=19&rcl=143099866
[2] https://www.chromium.org/Home/chromium-security/prefer-secure-origins-for-powerful-new-features and https://w3c.github.io/webappsec/specs/powerfulfeatures/
[3] https://code.google.com/p/chromium/codesearch#chromium/src/url/gurl.h&sq=package:chromium&type=cs&l=250&rcl=1430998666
BUG=362214
Review URL: https://codereview.chromium.org/1136643004
Cr-Commit-Position: refs/heads/master@{#329310}