Next steps for HTTPS state

[domenic]

HTTPS state causes issues with the secure context definition, as discussed in whatwg/html#4930 (comment). I've checked with folks on the Chrome side, and we no longer need the "deprecated" HTTPS state, so we can fix that issue. I'm willing to work on helping remove it.

However, I need some guidance. Can we remove the "HTTPS state" concept entirely? I'm not sure. The usage sites I've found are:

• Secure context definition only cares about "deprecated". So it won't use this.
• CORP check cares about "none". Could this use the response's URL's trustworthiness instead?
• Hyperlink auditing cares about "none". Could this use the Document's creation URL's trustworthiness instead? Or maybe it should be using an actual secure context check?

All other references to HTTPS state in HTML and Fetch appear to be plumbing from responses to new environment settings objects.

If we can't remove it, then: should we just keep the infrastructure as-is, and remove the "deprecated" state? Or maybe we should go further and rename things to make a bit more sense, e.g. change it to a "securely delivered" boolean? Are there other simplifications we could make?

[annevk]

If I look at how https://fetch.spec.whatwg.org/#concept-http-network-fetch sets it, what really matters is the scheme. If the scheme is not "https", it's equal to "none". Otherwise it could be "deprecated" or "modern". It doesn't seem to account at all for http://localhost/ and friends. Maybe it should, but that would be a separate normative change with tests we cannot really write using web-platform-tests...

[domenic]

OK. So where does that leave us? Should we remove HTTPS state entirely, or no?

[annevk]

Yeah, I think it can be removed in favor of scheme checks. That's all that remains once you remove "deprecated". As "deprecated" means the scheme is "https", the browser did get a response and accepted the TLS connection, but the browser also judges the TLS connection to be of poor quality.

[domenic]

Great, OK. So concretely, the CORP check and hyperlink auditing should use a straight-up scheme check. And in the future we can consider changing them to URL's trustworthiness, or secure context checks, as appropriate.

[annevk]

Yup!

[domenic]

I guess everything got merged, yay!