HTTPS pages should redirect IPFS subresources of a page to IPFS gateway

[kdenhartog]

We should automatically convert IPFS subresources being loaded in an HTTPS top level frame to a public gateway URL that relies upon HTTPS as well rather than block them. If the top level frame uses an IPFS scheme then the current method of loading it via the local node should be used instead.

[diracdeltas]

Noting that unless something regressed after #12546, IPFS resources loaded on HTTP(s) are already being blocked.

[kdenhartog]

I just double checked this and that's correct if the top level frame uses HTTPS scheme. If the top level frame is an IPFS scheme than the IPFS resource will be rendered still. I'll update the text here to be a bit more specific about this issue.

[kdenhartog]

Here's a good diagram to visualize how this should work from @vadimstruts shared in slack

[lidel]

Brave already has logic for detecting top-level IPFS resources based on the HTTPS URL in the address bar (path, subdomain, or dnslink gateways described here).

All these https:// variants are effectively the "Gateway" arrow in the above diagram.

Today, Brave detects and displays the badge on such pages:

I think @vadimstruts's diagram is ok, it shows how Brave can fix IPFS websites loaded via public HTTP gateways.

Loading ipfs:// URLs of subresources via public HTTP gateway the user has opted into respects user's choice, and probably the easiest to implement.

An alternative, more decentralized version (for path and subdomain URLs) is to use the same origin as path or subdomain gateway user currently is, so if user has preference to use https://dweb.link as their public gateway, and they are on cid.ipfs.cf-ipfs.com and they load ipfs://bafoo1 it could attempt fetch from https://cf-ipfs.com/ipfs/bafoo1 first (same gateway as parent page) instead of https://dweb.link/ipfs/bafoo1, and retry with dweb.link (cross-gateway fetch) only if the original gateway fails. This way, user would not leak subresource requests across different gateways. I guess this could also be a toggle option in settings, as users may prefer one way or another?

[kdenhartog]

Here's an updated diagram as well since @diracdeltas caught a problem when discussing further on slack.

[diracdeltas]

This is deprecated by #37735 since we won't support ipfs schemes anymore.