v154 · security · live probe

HTTP subresource lab

Ask-before-HTTP covers top-level navigations, but the same by-default-secure push decides what happens to http:// subresources: images get silently auto-upgraded to https, and active content gets blocked. This lab makes real requests from this page and reports the real outcome, read from load/error events and the Resource Timing entry each attempt leaves behind.

Which case is this page in?

reading…

Make a real request

Results (newest first)

how the outcome is read — no guessing

const img = new Image();
img.src = "http://placehold.co/120x60.png";   // note: http://
img.onload = () => {
  // Which URL did the browser ACTUALLY fetch? Resource Timing keeps
  // the real request URL. On an https page Chrome rewrites passive
  // mixed content to https before it ever hits the network, so the
  // entry appears under the https URL and the http one has no entry.
  performance.getEntriesByName(img.currentSrc ?? img.src);
};

// Active content is the opposite: fetch()/script/iframe over http
// from an https page is BLOCKED — the promise rejects with TypeError
// and no Resource Timing entry is created.

see also