HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
w3c
webappsec-mixed-content
HTML2017–2019
w3c / webappsec-mixed-content

webappsec-mixed-content

WebAppSec Mixed Content

Explore on GitHubRead Hacker News discussions
2Distinct people
3Mentions
0Explicit recommenders
14GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

WebAppSec Mixed Content

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month3 dated mentions

Observed mentions: 2017-06-20 15:49:55 UTC to 2019-07-10 19:12:05 UTC.

0122017-06-01 00:00:00 UTC to 2017-07-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsJun 20172017-07-01 00:00:00 UTC to 2017-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-08-01 00:00:00 UTC to 2017-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-09-01 00:00:00 UTC to 2017-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-10-01 00:00:00 UTC to 2017-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-11-01 00:00:00 UTC to 2017-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2017-12-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-01-01 00:00:00 UTC to 2018-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-02-01 00:00:00 UTC to 2018-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-03-01 00:00:00 UTC to 2018-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-04-01 00:00:00 UTC to 2018-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-05-01 00:00:00 UTC to 2018-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-06-01 00:00:00 UTC to 2018-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsJun 20182018-07-01 00:00:00 UTC to 2018-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-08-01 00:00:00 UTC to 2018-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-09-01 00:00:00 UTC to 2018-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-10-01 00:00:00 UTC to 2018-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-11-01 00:00:00 UTC to 2018-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-12-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2019-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-02-01 00:00:00 UTC to 2019-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-03-01 00:00:00 UTC to 2019-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-04-01 00:00:00 UTC to 2019-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-05-01 00:00:00 UTC to 2019-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-06-01 00:00:00 UTC to 2019-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-07-01 00:00:00 UTC to 2019-08-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 commentsJul 2019

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Jun 20172017-06-01 00:00:00 UTC2017-07-01 00:00:00 UTC101
Jul 20172017-07-01 00:00:00 UTC2017-08-01 00:00:00 UTC000
Aug 20172017-08-01 00:00:00 UTC2017-09-01 00:00:00 UTC000
Sep 20172017-09-01 00:00:00 UTC2017-10-01 00:00:00 UTC000
Oct 20172017-10-01 00:00:00 UTC2017-11-01 00:00:00 UTC000
Nov 20172017-11-01 00:00:00 UTC2017-12-01 00:00:00 UTC000
Dec 20172017-12-01 00:00:00 UTC2018-01-01 00:00:00 UTC000
Jan 20182018-01-01 00:00:00 UTC2018-02-01 00:00:00 UTC000
Feb 20182018-02-01 00:00:00 UTC2018-03-01 00:00:00 UTC000
Mar 20182018-03-01 00:00:00 UTC2018-04-01 00:00:00 UTC000
Apr 20182018-04-01 00:00:00 UTC2018-05-01 00:00:00 UTC000
May 20182018-05-01 00:00:00 UTC2018-06-01 00:00:00 UTC000
Jun 20182018-06-01 00:00:00 UTC2018-07-01 00:00:00 UTC000
Jul 20182018-07-01 00:00:00 UTC2018-08-01 00:00:00 UTC000
Aug 20182018-08-01 00:00:00 UTC2018-09-01 00:00:00 UTC000
Sep 20182018-09-01 00:00:00 UTC2018-10-01 00:00:00 UTC000
Oct 20182018-10-01 00:00:00 UTC2018-11-01 00:00:00 UTC000
Nov 20182018-11-01 00:00:00 UTC2018-12-01 00:00:00 UTC000
Dec 20182018-12-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
Jan 20192019-01-01 00:00:00 UTC2019-02-01 00:00:00 UTC000
Feb 20192019-02-01 00:00:00 UTC2019-03-01 00:00:00 UTC000
Mar 20192019-03-01 00:00:00 UTC2019-04-01 00:00:00 UTC000
Apr 20192019-04-01 00:00:00 UTC2019-05-01 00:00:00 UTC000
May 20192019-05-01 00:00:00 UTC2019-06-01 00:00:00 UTC000
Jun 20192019-06-01 00:00:00 UTC2019-07-01 00:00:00 UTC000
Jul 20192019-07-01 00:00:00 UTC2019-08-01 00:00:00 UTC202

What Hacker News says

3 sources
chrisfosterelli·Jul 10, 2019
This is discussed in the post text, but happy to elaborate here in more detail here! Here is the patch links from Firefox[0] and from Chrome[1] which they specify that active mixed content policies do not apply to the localhost, because the w3c specification was updated to specifically allow this behaviour[2]. You might have to use 127.0.0.1 directly. So yes, it is allowed. If for some reason that doesn't work for your app, the post also mention two secure alternatives: the native client can install a self-signed cert, or you can use a browser extension with the native messaging API. You touched on this too! My point here is not the specific example solution -- there's lots of alternatives and yes it depends on the situation and browser support requirements. But NONE of them are a reason to allow requests from every origin. [0]: https://b
Read the rest
ugzilla.mozilla.org/show_bug.cgi?id=903966 [1]: https://chromium.googlesource.com/chromium/src.git/+/130ee68... [2]: https://github.com/w3c/webappsec-mixed-content/commit/349501...
In Developers don't understand CORS
chrisfosterelli·Jul 10, 2019
This is discussed in the post text, but happy to elaborate here in more detail here! Here is the patch links from Firefox[0] and from Chrome[1] which they specify that active mixed content policies do not apply to the localhost, because the w3c specification was updated to specifically allow this behaviour[2]. You might have to use 127.0.0.1 directly. So yes, it is possible and not factually incorrect. If for some reason that doesn't work for your app, the post also mention two secure alternatives: the native client can install a self-signed cert, or you can use a browser extension with the native messaging API. [0]: https://bugzilla.mozilla.org/show_bug.cgi?id=903966 [1]: https://chromium.googlesource.com/chromium/src.git/+/130ee68... [2]: https://github.com/w3c/webappsec-mixed-content/commit/349501...
In Developers don't understand CORS
pilif·Jun 20, 2017
Yeah. The webpage is remote and using ssl and now wants to talk to the locally installed app. I agree that SSL doesn’t make sense there and honestly, in my opinion it would make sense for browsers to treat localhost as a secure origin. But they don’t and so we’re back to square one which is that a secured origin can’t make requests to a non secured origin. Update: newer browsers do in-fact do this. It’s also part of the WHATWG spec: https://github.com/w3c/webappsec-mixed-content/commit/349501... Of course there’s still IE and Edge that are of different minds, but it’s nice to see movement
In Cisco subdomain private key found in embedded executable

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.