Issue with "CSP: block-all-mixed-content": Deprecated without explanation or suggested replacement.

[collinanderson]

MDN URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content

What information was incorrect, unhelpful, or incomplete?

block-all-mixed-content is marked as deprecated, however, there's no explication as to why it's deprecated and no suggestion of a replacement.

What did you expect to see?

I expected to either see a suggested replacement, or at least an explication of why block-all-mixed-content should not be used in the future.

MDN Content page report details

• Folder: en-us/web/http/headers/content-security-policy/block-all-mixed-content
• MDN URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/block-all-mixed-content
• GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/http/headers/content-security-policy/block-all-mixed-content/index.md
• Last commit: 4623499
• Document last modified: 2021-08-13T16:17:49.000Z

[hamishwillee]

This was removed because it is obsolete. There is no replacement - it is simply not needed. From the spec: https://w3c.github.io/webappsec-mixed-content/#obsolescences :

An earlier version of this specification defined the block-all-mixed-content CSP directive. It is now obsolete, because all mixed content is now blocked if it can’t be autoupgraded.

I am hesitant to add a note because MDN has no policy on what you do about reasons and alternatives (and yes, it has come up a number of times). I have added discussion in https://github.com/mdn/content/discussions/5549#discussioncomment-1499176

[hamishwillee]

PS, if you even want to find out the reason, the best way is usually to do a git blame on the associated key in the https://github.com/mdn/browser-compat-data repository (which provides the compatibility information). That is usually the first place that gets updated and almost always contains a clear reason.

[collinanderson]

Interesting. I personally think the word "Deprecated" is fine, but yeah I feel like ideally when something gets marked as deprecated the MDN, some sort of explanation should get documented on MDN. Sounds like it's a bigger issue.

[hamishwillee]

Deprecated is fine for me too, but it gets misinterpreted and overloaded. My bigger problem is the same as you - I want to know what I should use instead and I want to be sure it is really deprecated and not applied by accident (for which a reason is the best solution).

[hamishwillee]

Anyway, decided to add a reason. Does not harm.

[collinanderson]

Thanks!