Ssl – How to do about a mixed content warning on the website

mixed-contentsslwebsite

My server is configured to use HTTPS only; this works okay.

But when I visit the website I get this message in Firefox (next to the URL bar):

Firefox is blocking content on this page
Most websites will work properly even if content is blocked.

Insecure content
Some unencrypted elements on this website have been blocked.

The website works fine, I just hate having that message and not knowing what it means.

Is there some way to determine what exactly is being blocked? I tried turning off certain features on the website one by one, but couldn't find what's causing this.

This happens only in Firefox. Chrome shows no error messages.

Firebug says:

Blocked loading mixed active content "http://jqueryapi.info/?getsrc=ok&ref=https%3A%2F%2Fexample.com%2F"

This appears to be caused by javascript obfuscation. If I change the javascript code to normal, this doesn't happen. So now I wonder is there a way to bypass this?

Best Answer

You asked: "Is there some way to determine what exactly is being blocked?", and the answer is yes.

Definitely, the most effective way to check what is going wrong within your browser is... to ask directly to the browser :-)

Recent version of modern browsers (like Firefox and Chromium/Chrome) includes a "Developer tool" which, among lots of other things, can report exactly which HTTP request the browser is sending over the network and, for each of them, which response got back (if any...) from the remote webserver.

In Chrome/Chromium world, the developer tools can be accessed with CTRL-SHIFT-I or, if you prefer menu path, "Tools"=>"Developer Tools"

In firefox (at least in mine, v. 33) the sequence is the same.

Once you have "Developer Tools" activated, you can select the "Network" tab. Afterwards, if you point the browser to your original URL, than the browser will reports all the details.

Also, I suggest also to check the "console" (select proper "tab" within the "developer tools" area) as it may contains lots of useful information, at least when you're experiencing some problems :-)

P.S.: as for the message reported by the browser (Some unencrypted elements on this website have been blocked), I bet the browser is complaining because you're accessing an SSL-protected URL and the HTML that is coming back from such URL does contain some reference to other resources (CSS, images, scripts, etc.) accessible with standard HTTP, without SSL protection. So, the browser, instead of sending clear context over the network, decides to "block" them.

Related Solutions

Ssl – SharePoint MOSS – Serve HTTP content on an HTTPS page without Mixed Content Warning

I would advise against changing the Zone settings as well. I resolved this issue using a small tweak to the XSL of the SharePoint RSS Web Part here:

Stop mixed content warnings in SharePoint's RSS Web Part

<xsl:template name="GetSafeHtml">
    <xsl:param name="Html"/>
    <xsl:choose>
        <xsl:when test="$rss_IsDesignMode = 'True'">
            <xsl:call-template name="strip-tags">
                <xsl:with-param name="text" select="$Html"/>
            </xsl:call-template>
        </xsl:when>
        <xsl:otherwise>
            <xsl:call-template name="strip-tags">
                <xsl:with-param name="text" select="rssaggwrt:MakeSafe($Html)"/>
            </xsl:call-template>
        </xsl:otherwise>
    </xsl:choose>
</xsl:template>

<xsl:template name="strip-tags">
    <xsl:param name="text"/>
    <xsl:choose>
        <xsl:when test="contains($text, '&lt;')">
            <xsl:value-of select="substring-before($text, '&lt;')"/>
            <xsl:call-template name="strip-tags">
                <xsl:with-param name="text" select="substring-after($text, '&gt;')"/>
            </xsl:call-template>
        </xsl:when>
        <xsl:otherwise>
            <xsl:value-of select="$text"/>
        </xsl:otherwise>
    </xsl:choose>
</xsl:template>

Basically, you paste over the GetSafeHtml template with a slightly modified version that calls a strip-tags template.

Good luck!

Ssl – Allow active mixed content (iframes) with SSL and Content Security Policies

You can't disable the mixed security check at site level. If browser would allow it, this behavior will provide a false sense of security and defeat the trust on the use of HTTPS.

Some browsers allow the setting to be disabled on per-installation basis. For example, you can disable the check in Firefox by changing the setting

security.mixed_content.block_active_content

in about:config.

Chrome doesn't allow it explicitly, and the only way is to click on load anyway. It is also worth to mention that newer versions of Chrome no longer display a crossed padlock, instead Chrome will essentially downgrade the security of the page to HTTP if you load any HTTP content.

Best Answer

Related Solutions

Ssl – SharePoint MOSS – Serve HTTP content on an HTTPS page without Mixed Content Warning

Ssl – Allow active mixed content (iframes) with SSL and Content Security Policies

Related Topic