An archive viewer served over HTTPS loads a plaintext script and a plaintext scanned image - why is only one blocked?

## The document is trustworthy; its ingredients are separate requests A page delivered over HTTPS arrives authenticated and encrypted. Every subresource it names - a script, a stylesheet, a scanned plate, an oral-history recording - is a **separate request with its own URL**, and the guarantee the document arrived with does not travel to any of them. **Mixed content** is the name for that gap: a request is mixed content when the context responsible for it is potentially trustworthy and the request's own URL is not. The check does not look at the file at the other end. It looks at what the request is **for** - its destination - because that decides how much an attacker sitting on the plaintext path can do with it. ## Two categories, two outcomes - **Upgradeable mixed content** - called *optionally-blockable* in earlier drafts of the specification - is narrow on purpose: a request whose destination is `image` **with an empty initiator**, or `video`, or `audio`. Nothing else is in it. - **Blockable mixed content** is everything else, and it is **failed as a network error**. | The request | Category | Outcome | |---|---|---| | `<script src="http://...">` | blockable | request fails; the script never runs | | `<link rel="stylesheet" href="http://...">` | blockable | request fails; the rules never apply | | `<img src="http://...">` | upgradeable | URL rewritten to `https`, then fetched | | `<audio src="http://...">`, `<video src="http://...">` | upgradeable | same rewrite | | a plate chosen through `<picture>` or a `srcset` candidate | blockable | its initiator is not the empty string, so the narrow definition misses it | | an image requested in CORS mode | force-failed | not rewritten, not loaded | That `<picture>` row is the trap in a real migration: the same file, addressed two ways, gets two different verdicts. ## Why the line is drawn there A plaintext script is **executed**. Whoever controls the plaintext path controls what runs, which means the whole document - its markup, its storage, anything a user types into it. A stylesheet is barely weaker: it can reposition and restyle anything on the page. That class cannot be allowed to load at all, so it is failed rather than warned about. A plate or a recording is rendered, not executed. It cannot rewrite the page - but "cannot execute" is not "harmless". Someone on the path can swap a scanned plate for a different one, or an interview recording for a different voice, which for an archive is precisely the thing the archive exists to prevent. That is why the answer to the passive case moved from *warn* to *upgrade*. ## What the autoupgrade actually does 1. It rewrites the **scheme** to `https`. Host, path and query are untouched, and an explicit default plaintext port is dropped so the request lands on the default secure port. 2. It needs **no opt-in** - no directive, no header, no markup change. 3. If the upgraded request fails, **it fails**. There is no fallback to plaintext, no probing for an alternative, no cached plaintext copy. The image is simply absent. Point 3 is what surprises people who assume an upgrade is free. If the host holding two decades of plates has no TLS listener at all, the autoupgrade turns a picture that used to render into a picture that does not. ## Reading the outcome On the console the two cases read differently, and telling them apart is most of the diagnosis: - an **upgraded** request logs that a plaintext URL was automatically rewritten, and the request you see on the wire is an `https` URL you never typed; - a **blocked** request logs that a specific URL was refused because the page was loaded over HTTPS, and nothing is fetched at all; - a **navigation** to a plaintext address is neither: a top-level navigation is not mixed content, and a plaintext form action is a warning surface rather than a blocked subresource. ## The claim the padlock actually makes "The padlock is there" says the document arrived over a trustworthy connection. "Every byte on this page was authenticated" is a different claim, and the distance between the two is exactly the set of subresources that escaped the migration. A migration is finished when no catalogue record still hands the viewer an absolute plaintext address - not when the address bar looks right.