Mixed content

Visitors can check out the Forum FAQ by clicking this link. You have to register before you can post: click the REGISTER link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. View our Forum Privacy Policy.
Want to receive the latest contracting news and advice straight to your inbox? Sign up to the ContractorUK newsletter here. Every sign up will also be entered into a draw to WIN £100 Amazon vouchers!

You are not logged in or you do not have permission to access this page. This could be due to one of several reasons:

You are not logged in. If you are already registered, fill in the form below to log in, or follow the "Sign Up" link to register a new account.
You may not have sufficient privileges to access this page. Are you trying to edit someone else's post, access administrative features or some other privileged system?
If you are trying to post, the administrator may have disabled your account, or it may be awaiting activation.

NickFitz replied

20 September 2010, 17:03
Originally posted by k2p2 View Post

Full marks Nick - site correctly requesting https. Apache config then redirecting to http.
Leave a comment:
mudskipper replied

20 September 2010, 15:10
Originally posted by NickFitz View Post

(N.B.: if they've cocked-up the server and are redirecting requests from https to http that will cause the message; you can use Fiddler to check for that.)

Full marks Nick - site correctly requesting https. Apache config then redirecting to http.
Leave a comment:
mudskipper replied

18 September 2010, 21:17
Originally posted by NickFitz View Post

https has to start at the client. If it makes an http request, and the server redirects it to https, then it repeats the request using https. If the client is making a request for a page over https, and then requesting content referenced by that page over http, then there must be something in that page specifying that the content should come over http. Relative URLs are relative to the URL of the containing page, unless overridden by a <base> tag.

(N.B.: if they've cocked-up the server and are redirecting requests from https to http that will cause the message; you can use Fiddler to check for that.)

However, IE8 will also throw up the mixed content warning if they are using javascript: URLs in certain circumstances. Search the source for anything like javascript:void. Also have a look in any JavaScript libraries they are using; some of them use a trick to get IE to simulate the DOMLoaded event that involves writing out a <script src="javascript:void(0)" defer> tag, which will trigger the warning. I believe JQuery and YUI have both had this problem in certain versions, and both have fixes available.

Also, check out this post by MS's Eric Law.

Thanks Nick - I'd found some posts about the javascript:void(0) thing - can't find any instances, although they are using jquery. Will check again on Monday.
Leave a comment:
NickFitz replied

18 September 2010, 21:11
Originally posted by k2p2 View Post

There is shedloads of unused stuff. The HTML is truly shocking - badly formed, code between </head> and <body> - a real mess. Hardly surprising there's problems. Not sure what you mean by unreferenced.

My question was really how apache deals with it - I'm guessing they're using a Rewrite to map http to https for the secure pages. If they are, does stuff with a relative path also come over https? Http watch would suggest not.

https has to start at the client. If it makes an http request, and the server redirects it to https, then it repeats the request using https. If the client is making a request for a page over https, and then requesting content referenced by that page over http, then there must be something in that page specifying that the content should come over http. Relative URLs are relative to the URL of the containing page, unless overridden by a <base> tag.

(N.B.: if they've cocked-up the server and are redirecting requests from https to http that will cause the message; you can use Fiddler to check for that.)

However, IE8 will also throw up the mixed content warning if they are using javascript: URLs in certain circumstances. Search the source for anything like javascript:void. Also have a look in any JavaScript libraries they are using; some of them use a trick to get IE to simulate the DOMLoaded event that involves writing out a <script src="javascript:void(0)" defer> tag, which will trigger the warning. I believe JQuery and YUI have both had this problem in certain versions, and both have fixes available.

Also, check out this post by MS's Eric Law.
Leave a comment:
Saddo replied

18 September 2010, 21:06
I use HTML Validator to check the HTML content for different browsers - there is a free version:

CSE HTML Validator - Powerful HTML Validator, XHTML Validator, CSS Validator, and More
Leave a comment:
mudskipper replied

18 September 2010, 20:34
OK - convinced myself there is definitely unsecure content. Have sent polite email to developers. Not my job to sort it thankfully

Thanks for the suggestions - just wanted to check I wasn't misunderstanding http watch - pretty sure I'm not.
Leave a comment:
mudskipper replied

18 September 2010, 20:10
Originally posted by Cliphead View Post

Do you have any unreferenced / unused images in CSS or code?

There is shedloads of unused stuff. The HTML is truly shocking - badly formed, code between </head> and <body> - a real mess. Hardly surprising there's problems. Not sure what you mean by unreferenced.

My question was really how apache deals with it - I'm guessing they're using a Rewrite to map http to https for the secure pages. If they are, does stuff with a relative path also come over https? Http watch would suggest not.
Leave a comment:
mudskipper replied

18 September 2010, 20:04
Originally posted by NickFitz View Post

Have you checked the HTML for a <base> element, e.g. <base href="http://example.com/">? That would cause relative paths to use http rather than https.

No base tag.
Leave a comment:
Cliphead replied

18 September 2010, 19:16
Do you have any unreferenced / unused images in CSS or code?
Leave a comment:
NickFitz replied

18 September 2010, 19:14
Have you checked the HTML for a <base> element, e.g. <base href="http://example.com/">? That would cause relative paths to use http rather than https.
Leave a comment:
mudskipper replied

18 September 2010, 17:21
Thought about this - I reckon they've configured specific paths to be secure, but because the js and images are in a common part of the directory structure they're not coming in on https.

Surely can't be that obvious - this has been P1 issue for months...
Leave a comment:
mudskipper started a topic Mixed content

18 September 2010, 14:41
Mixed content

Really noddy question...

Currently testing website for clientCo. For the past 2 months we've been logging issues around mixed content messages. IE8 is completely bust - none of the AJAX calls work unless you explicitly configure the browser to allow mixed content.

The developers (a well known offshore outfit) seem to be struggling with this - they've brought in consultants for what is known as "the IE8 issue" but been unable to resolve it. Other browsers (e.g firefox) show broken padlock but don't actually give a warning message.

The site is on apache and I understand the https is configured there. My background is IIS and we always set up https in the code, so my understanding of apache config is based on my good friend google.

I have no access to source, but looking at the html, the calls to js and many of the images are using relative paths.

When I use http watch to see what is being delivered, all the js and some of the images are showing as coming over http. The main page content is shown as https

Onshore rep of offshore company is telling me that apache steps in and delivers the content over https anyway. But http watch (and firebug and everything else!) shows http.

If http watch shows http does that mean it's http? Either there's a gap in my understanding, or they're missing the obvious. Don't want to escalate it if I'm gonna look stupid...

TIA
Tags: None