title: Mixed Content , Content-Security-Policy and hash-source
body: <p>I'd like to open an HTTP Iframe inside an HTTPS page. Of course this is not normally possible as it will trigger an 'mixed-content' violation.</p>
  
  <p>Is there any way to by-pass a mixed content block using "Content-Security-Policy" and hash sources ?</p>
  
  <p>Example:</p>
  
  <ul>
  <li><code>http://mysite/my-frame.html</code> has an sha-256 hash of <code>sha256-xxxyyy....zzz</code></li>
  <li><p><code>https://mysite/index.html</code> will be served with a <code>Content-Security-Policy</code> header as follow (or inlines an equivalente <code>&lt;meta&gt;</code> tag)  as long as CORS headers:</p>
  
  <ul>
  <li><code>Content-Security-Policy: frame-src sha256-xxxxyyyy....zzz</code></li>
  </ul></li>
  <li><p><code>https://mysite/index.html</code> includes an <code>&lt;iframe src='http://mysite/my-frame.html'&gt;</code></p></li>
  </ul>
  
  <p>Will this work ? Is there any other method to make this possible.</p>
  
  <p><em>note</em>: No <code>upgrade-insecure-requests</code> will not work because the page is a navigational request AND the frame HAS to be served from HTTP.</p>