Upgrade Insecure Requests
November 28, 2017
The "Upgrade Insecure Requests" Content Security Policy can be used to automatically upgrade insecure (e.g. http:) requests to a secure alternative (e.g. https:) before a browser fetches them.
In practice, this helps avoid mixed-content warnings when a page is accessed via https:, but it contains references to resources using absolute http: URLs.
Like other Content Security Policies, the recommend approach is to enable it via a HTTP response header:
Content-Security-Policy: upgrade-insecure-requests
Nginx example:
add_header Content-Security-Policy upgrade-insecure-requests;
However, if you do not have control over the underlying web server, an
alternative is to include this meta tag in your HTML's <head>
:
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
More info:
https://googlechrome.github.io/samples/csp-upgrade-insecure-requests/