What happens to ressources which can't be upgraded to https (e.g. invalid certificate)? Will they be blocked?
The request will be made over HTTPS. If the request fails, then it fails. To do otherwise would open the system up to downgrade attacks, making it effectively useless against a MITM attacker.
This behavior is specified in the Fetch Standard from the WHATWG (which is referenced in the upgrade-insecure-requests spec):
- Upgrade request to a potentially secure URL, if appropriate.
Since this step happens before any actual network requests are made, the rest of the process behaves exactly as if the request was originally made as HTTPS from the beginning.
What kind of violations will be reported against the endpoint specified by
report-uri in the policy? Just failed upgrades or also successful upgrades?
No violations will be reported by a CSP directive using
upgrade-insecure-requests. According to the spec:
Monitoring the upgrade-insecure-requests directive has no effect: the directive is ignored when sent via a Content-Security-Policy-Report-Only header. Authors can determine whether or not upgraded resources' original URLs were insecure via Content-Security-Policy-Report-Only. For example,
: default-src https:; report-uri /endpoint. See §3.4 Reporting Upgrades for additional detail.
So if you want information on which requests are being upgraded using CSP, you must use a hard fail (not
upgrade-insecure-requests) with the Report-Only header.
Section 3.4 further explains this in example 9:
Within the context of a protected resource which contains the insecure image
<img src="http://example.com/image.png">, and delivers the following HTTP headers:
Content-Security-Policy: upgrade-insecure-requests; default-src https:
Content-Security-Policy-Report-Only: default-src https:; report-uri /endpoint
The user agent will fire off a request request that:
- Violates the policy being monitored, thereby delivering a violation report to /endpoint.
- Is upgraded from http://example.com/image.png to https://example.com/image.png.
- Does not violate the policy being enforced.
Note that point 3 here is key. Since the request is upgraded in step 2, the request does not "violate the policy being enforced". According to the CSP spec, only violations of the CSP policy are reported:
When one or more of a policy’s directives is violated, a violation report may be generated and sent out to a reporting endpoint associated with the policy.