MSE does not work with Mixed Content, unlike video/audio.src=

[wolenetz]

Migrated from w3c bugzilla tracker. For history prior to migration, please see:
https://www.w3.org/Bugs/Public/show_bug.cgi?id=28465

[jdsmith3000]

I believe we should reconsider marking this V.Next, since it is dependent on changes to other specs:

TL;DR Proposal first:

• Amend MIX in [4] to add "fetch" as an optionally-blockable-request-
  context
  • This means that fetch() can now return HTTP content from HTTPS
    pages. The implications of this, however, are described below, if you
    can handle reading it all.
• Amend MSE in [5] to introduce a new method, appendResponse(Response
  response), which accepts a Response [6] class
• In MSE, define a Response Append Loop similar to the Stream Append
  Loop [7], that calls the consume body algorithm [8] on the internal
  response [9] of Response to yield an ArrayBuffer, then executes the
  buffer append [10] algorithm on the SourceBuffer

[wolenetz]

@jdsmith3000, I don't think the previous proposal was to add an appendResponse() method. Where are you finding this as the most recent proposal?

[ddorwin]

@jdsmith3000's text comes from the original proposal. @wolenetz later said, "we believe we can and should reuse appendStream() rather than adding appendResponse()."

I think the main work required in the MSE spec would be to finish appendStream (issue #14). Beyond that, there might be some text about opaque streams

[jdsmith3000]

Okay, this makes sense. Assuming we agree to update the stream API feature, this comment about using it for mixed content makes sense. I have some mixed feelings about its benefit, but I'm okay with adding it.

[wolenetz]

Support for this as v1 was also provided by rus@ during TPAC MSE f2f. Given mixed content MSE is needed sooner (due to other priveleged APIs coming sooner) rather than later, consensus is this is v1 and blocked on #14.

[wolenetz]

While there may still be future progress on the appendStream case for non-mixed content, our previous attempt to get opaque response/etc were declined from the fetch API, mostly for the potential for increasing the risk of accidentally leaking content in implementations from insecure media to a secure site. (See yutakahirano/fetch-with-streams#56).

If there is strong support for this being in MSE in future, please re-open.