Can't play Youtube videos when navigating in HTTPS

[David Barth]

The bug can be reproduced by starting from the Movies scope, and clicking on a video.

This will start webbrowser-app with an HTTPS url on Youtube.

The following warning appears in the logs, and the video doesn't start when trying to play it.

qml: [JS] (https://m.youtube.com/watch?v=nZx4MichXXE:0) [blocked] The page at 'https://m.youtube.com/watch?v=nZx4MichXXE' was loaded over HTTPS, but displayed insecure content from 'http://r6---sn-25ge7ney.googlevideo.com/videoplayback?upn=PcPopIJf7p0&id=o-AGkFTMN8JQ-yZCw2nM5XPxBHyoPxExm9gsAMeVKaH8JH&el=watch&ipbits=0&key=yt5&ip=92.128.115.42&yms=5moT2U-ZGJk&ms=au&mv=m&mt=1407752917&dnc=1&mm=31&expire=1407774582&itag=18&fexp=902408%2C927622%2C931983%2C934024%2C934030%2C946023&sparams=id%2Cip%2Cipbits%2Citag%2Cratebypass%2Csource%2Cupn%2Cexpire&source=youtube&mws=yes&sver=3&app=youtube_mobile&signature=6E015C4C4A84AD0ECD8B1093B021024B6061861E.75BEA37499268D11071F183D2413194DCC87C3FF&ratebypass=yes&cpn=u5ShHxp38NX3j1cH': this content should also be loaded over HTTPS.

If modifying the URL back to plain HTTP, then it works.

[Chris Coulson (chrisccoulson)]

The browser (well, Oxide) is behaving correctly here by blocking the insecure content. There isn't an API to tell the browser the content has been blocked or provide a way for the user to override the error at the moment, but in any case this is a website bug

https://support.google.com/chrome/answer/1342714?hl=en

[David Barth (dbarth)]

It feels strange that such a bug affects Youtube if the behavior is the
same on Android. Can it be that the browser gets a popuip / redirect or
something that goes wrong and scrambles the URLs from https into http?

On Tue, Aug 12, 2014 at 5:10 PM, Chris Coulson <email address hidden>
wrote:

> The browser (well, Oxide) is behaving correctly here by blocking the
> insecure content. There isn't an API to tell the browser the content has
> been blocked or provide a way for the user to override the error at the
> moment, but in any case this is a website bug
>
> https://support.google.com/chrome/answer/1342714?hl=en
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1355120
>
> Title:
> Can't play Youtube videos when navigating in HTTPS
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/webbrowser-app/+bug/1355120/+subscriptions
>

[Olivier Tilloy (osomon)]

On android, the videos play when browsed to over https, but the browser warns of insecure content being loaded over a secure connection.

[David Barth (dbarth)]

Ah, so that's really a web site bug!

Now, can this warning be surface in the current state of things, or do we
need that SSL Status API?

On Wed, Aug 13, 2014 at 7:46 AM, Olivier Tilloy <
<email address hidden>> wrote:

> *** This bug is a duplicate of bug 1355818 ***
> https://bugs.launchpad.net/bugs/1355818
>
> On android, the videos play when browsed to over https, but the browser
> warns of insecure content being loaded over a secure connection.
>
> ** This bug has been marked a duplicate of bug 1355818
> Youtube launched with https and cannot play insecure content
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1355120
>
> Title:
> Can't play Youtube videos when navigating in HTTPS
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/webbrowser-app/+bug/1355120/+subscriptions
>

[Olivier Tilloy (osomon)]

> Now, can this warning be surface in the current state of things, or do we
> need that SSL Status API?

We’ll need the SSL status API indeed (and a way to allow insecure content to be loaded over a secure connection, if it’s not already exposed in the preferences).