The nightly builds of Firefox, based on which the release of Firefox 76 will be formed on May 5, optional the "HTTPS Only" feature, which, when enabled, will automatically redirect all unencrypted requests to secure page variants ("http://" to "https://"). A setting "dom.security.https_only_mode" has been added in about:config to enable the mode.
The replacement will occur both at the level of resources loaded on the pages and when entering in the address bar. The new mode addresses the opening of pages by default using "http://", without the option to change this behavior. Despite significant efforts to promote HTTPS in browsers, when entering a domain in the address bar without specifying a protocol, "http://" continues to be used by default. The proposed setting changes this behavior and also includes automatic replacement to "https://" when explicitly entering an address with "http://".
If a request to primary pages (entering a domain in the address bar) via https:// times out, the user will see an error page with a button to perform the request via http://. In the case of failures when loading sub-resources via "https://" during page processing, such failures will be ignored, but warnings will be printed in the web console, which can be viewed through web developer tools.
In Chrome, work is also to block unprotected loading of sub-resources. For example, the release of Chrome 81 was expected to activate a new protection mode against loading mixed multimedia content (when resources are loaded via http:// on an HTTPS page). On pages opened via HTTPS, links "http://" will be automatically replaced with "https://" when loading images (in Chrome 80, replacement for scripts, iframes, audio, and video files was added). In future releases of Chrome, the transition to blocking file downloads via HTTP.
Source: opennet.ru
