--- a/dom/webidl/MediaKeyMessageEvent.webidl
+++ b/dom/webidl/MediaKeyMessageEvent.webidl
@@ -12,17 +12,17 @@
 
 enum MediaKeyMessageType {
   "license-request",
   "license-renewal",
   "license-release",
   "individualization-request"
 };
 
-[Constructor(DOMString type, MediaKeyMessageEventInit eventInitDict)]
+[SecureContext, Constructor(DOMString type, MediaKeyMessageEventInit eventInitDict)]
 interface MediaKeyMessageEvent : Event {
   readonly attribute MediaKeyMessageType messageType;
   [Throws]
   readonly attribute ArrayBuffer message;
 };
 
 dictionary MediaKeyMessageEventInit : EventInit {
   required MediaKeyMessageType messageType;

--- a/dom/webidl/MediaKeySession.webidl
+++ b/dom/webidl/MediaKeySession.webidl
@@ -5,16 +5,17 @@
  *
  * The origin of this IDL file is
  * https://dvcs.w3.org/hg/html-media/raw-file/default/encrypted-media/encrypted-media.html
  *
  * Copyright © 2014 W3C® (MIT, ERCIM, Keio, Beihang), All Rights Reserved.
  * W3C liability, trademark and document use rules apply.
  */
 
+[SecureContext]
 interface MediaKeySession : EventTarget {
   // error state
   readonly attribute MediaKeyError? error;
 
   // session properties
   readonly attribute DOMString sessionId;
 
   readonly attribute unrestricted double expiration;

--- a/dom/webidl/MediaKeyStatusMap.webidl
+++ b/dom/webidl/MediaKeyStatusMap.webidl
@@ -15,15 +15,16 @@ enum MediaKeyStatus {
   "expired",
   "released",
   "output-restricted",
   "output-downscaled",
   "status-pending",
   "internal-error"
 };
 
+[SecureContext]
 interface MediaKeyStatusMap {
   iterable<ArrayBuffer,MediaKeyStatus>;
   readonly attribute unsigned long size;
   boolean has (BufferSource keyId);
   [Throws]
   any get (BufferSource keyId);
 };

--- a/dom/webidl/MediaKeySystemAccess.webidl
+++ b/dom/webidl/MediaKeySystemAccess.webidl
@@ -26,15 +26,16 @@ dictionary MediaKeySystemConfiguration {
   sequence<DOMString>                     initDataTypes = [];
   sequence<MediaKeySystemMediaCapability> audioCapabilities = [];
   sequence<MediaKeySystemMediaCapability> videoCapabilities = [];
   MediaKeysRequirement                    distinctiveIdentifier = "optional";
   MediaKeysRequirement                    persistentState = "optional";
   sequence<DOMString>                     sessionTypes;
 };
 
+[SecureContext]
 interface MediaKeySystemAccess {
   readonly    attribute DOMString keySystem;
   [NewObject]
   MediaKeySystemConfiguration getConfiguration();
   [NewObject]
   Promise<MediaKeys> createMediaKeys();
 };

--- a/dom/webidl/MediaKeys.webidl
+++ b/dom/webidl/MediaKeys.webidl
@@ -13,16 +13,17 @@
 // Note: "persistent-usage-record" session type is unsupported yet, as
 // it's marked as "at risk" in the spec, and Chrome doesn't support it. 
 enum MediaKeySessionType {
   "temporary",
   "persistent-license",
   // persistent-usage-record,
 };
 
+[SecureContext]
 interface MediaKeys {
   readonly attribute DOMString keySystem;
 
   [NewObject, Throws]
   MediaKeySession createSession(optional MediaKeySessionType sessionType = "temporary");
 
   [NewObject]
   Promise<void> setServerCertificate(BufferSource serverCertificate);

--- a/dom/webidl/Navigator.webidl
+++ b/dom/webidl/Navigator.webidl
@@ -344,17 +344,17 @@ partial interface Navigator {
 };
 
 partial interface Navigator {
   [NewObject, Func="mozilla::dom::TCPSocket::ShouldTCPSocketExist"]
   readonly attribute LegacyMozTCPSocket mozTCPSocket;
 };
 
 partial interface Navigator {
-  [NewObject]
+  [NewObject, SecureContext]
   Promise<MediaKeySystemAccess>
   requestMediaKeySystemAccess(DOMString keySystem,
                               sequence<MediaKeySystemConfiguration> supportedConfigurations);
 };
 
 [NoInterfaceObject, Exposed=(Window,Worker)]
 interface NavigatorConcurrentHardware {
   readonly attribute unsigned long long hardwareConcurrency;