[Security] Upgrade passive mixed content to HTTPS

[dipikabh]

Acceptance criteria

• The listed features are documented sufficiently on MDN
• BCD is updated
• Interactive example and data repos are updated if appropriate
• The content has been reviewed as needed

For folks helping with Firefox related documentation

• Set bugs to dev-doc-complete
• Add entry to Firefox release notes for enabled/preview features
• Add/remove entry to Firefox experimental features page for preference/released features

Related Gecko bugs

• Bug 1779757: [meta] Implement Mixed Content Level 2

• "Intent to Ship":

  • Summary: Currently, Firefox is loading passive mixed content. These are loads of type image, audio and video with an HTTP URL while the top-level document load is over HTTPS. With this feature, we will automatically upgrade image, audio and video elements to HTTPS. There will be no fallback to HTTP. If such a subresource is unavailable over HTTPS, it will just not load. This aligns us with the latest revision of the Mixed Content specification. - This feature is currently undergoing a gradual roll-out, where up to 40% of our users are already experiencing this behavior.
  • Specification: https://w3c.github.io/webappsec-mixed-content/
  • Preference: The pref security.mixed_content.upgrade_display_content will be set to true.
  • This feature is already enabled in Nightly-only

Related pages on MDN

• https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content
• https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Experimental_features#upgrading_mixed_display_content

Other

• Check content open issues to see if any pertain to the subject matter. If there are any that can be closed because of the work, do so. If there are any that can be fixed relatively quickly because of the knowledge from completing this issue and you have time, feel free to go ahead and fix them.

[hamishwillee]

See also #33696 that will be fixed if this is done right

[hamishwillee]

Status:

• BCD HTTP Mixed-content - add feature browser-compat-data#23220
• Docs
  • Mixed content - update to match spec terminology Mixed Content update to new spec #33786
  • How to fix a website with blocked mixed content - deleted/merged - Mixed Content update to new spec #33786
  • Check all other uses of term, including CSP headers like "CSP: upgrade-insecure-requests" which may be deprecated
• Experimental features (remove) FF127 Relnote - mixed content requests auto upgraded to secure #33784
• Release note (add) FF127 Relnote - mixed content requests auto upgraded to secure #33784
• dev-docs-complete