Windows 8.1 allows only https URIs, not http URIs

Platforms

Clients - Windows 8.1 Servers - Windows Server 2012 R2

Description

While apps built for Windows 8 can include http and https URIs in their application content URIs, apps built for Windows 8.1 may include only https URIs.

The only exception is for dynamic ContentUriRules that are specified in the app’s AppxManifest.xml file. With dynamic ContentUriRules, apps can access additional domains or network resources that are provided by the admin, such as Group Policy URIs. However, dynamic ContentUriRules are only available to Windows Store apps if they meet these conditions:

  • The Group Policy is enabled
  • The package has specified the enterpriseAuthentication capability
  • The package’s OSMaxVersionTested is Windows 8.1 or greater

The new restrictions in Windows 8.1 are part of enhanced security restrictions to further protect the platform.

Manifestations

When running an app built for Windows 8 on Windows 8.1, the use of http URIs in the ApplicationContentUriRules is allowed.

Mitigations

We recommend that WWA developers switch from