R – How to avoid security message in IE7 when using HTTPS

httpsinternet explorerwarnings

In IE7 my web site always causes the browser to prompt a "Security Information" dialogue box:

This page contains both secure and
non-secure items.

Do you want to display the non-secure items?

How can I avoid getting this message when traveling between non-secure and secure pages (HTTP to HTTPS)?

Best Answer

You need to make sure all your images, script files, CSS files and so on have HTTPS urls if you're on a secure page.

If you view-source and search for "http:" this will soon tell which one (or more) is wrong.

Example:

<script src="script.js" type="text/javascript"></script> - Correct
<script src="https://ssl.google.com/ga.js" type="text/javascript"></script> - Correct
<script src="http://www.google.com/ga.js" type="text/javascript"></script> - Wrong

Related Solutions

Javascript – Coding Dojo with IE and SSL

After reviewing the JavaScript sourcecode for Dijit, I thought it was likely the error results from an "insecure" refrence to a dynamically generated IFRAME. Note there are two versions of the script file, the uncompressed represents the original source (dijit.js.uncompressed.js) and the standard (dijit.js) has been compressed for optimal transfer time.

Since the uncompressed version is the most readable, I will describe my solution based on that. At line #1023, an IFRAME is rendered in JavaScript:

if(dojo.isIE){
    var html="<iframe src='javascript:\"\"'"
           + " style='position: absolute; left: 0px; top: 0px;"
           + "z-index: -1; filter:Alpha(Opacity=\"0\");'>";
    iframe = dojo.doc.createElement(html);
}else{...

What's the problem? IE doesn't know if the src for the IFRAME is "secure" - so I replaced it with the following:

if(dojo.isIE){
    var html="<iframe src='javascript:void(0);'"
           + " style='position: absolute; left: 0px; top: 0px;"
           + "z-index: -1; filter:Alpha(Opacity=\"0\");'>";
    iframe = dojo.doc.createElement(html);
}else{...

This is the most common problem with JavaScript toolkits and SSL in IE. Since IFRAME's are used as shims due to poor overlay support for DIV's, this problem is extremely prevalent.

My first 5-10 page reloads are fine, but then the security error starts popping up again. How is this possible? The same page is "secure" for 5 reloads and then it is selected by IE as "insecure" when loaded the 6th time.

As it turns out, there is also a background image being set in the onload event for dijit.wai (line #1325). This reads something like this;

div.style.cssText = 'border: 1px solid;'
                  + 'border-color:red green;'
                  + 'position: absolute;'
                  + 'height: 5px;'
                  + 'top: -999px;'
                  + 'background-image: url("' + dojo.moduleUrl("dojo", "resources/blank.gif") + '");';

This won't work because the background-image tag doesn't include HTTPs. Despite the fact that the location is relative, IE7 doesn't know if it's secure so the warning is posed.

In this particular instance, this CSS is used to test for Accessibility (A11y) in Dojo. Since this is not something my application will support and since there are other general buggy issues with this method, I opted to remove everything in the onload() for dijit.wai.

All is good! No sporadic security problems with the page loads.

How to show a message to IE6/IE7 browsers to upgrade to IE8 and have IE8 not show the IE7 warning

Use this tag:

<meta http-equiv="X-UA-Compatible" content="IE=8" />

Best Answer

Related Solutions

Javascript – Coding Dojo with IE and SSL

How to show a message to IE6/IE7 browsers to upgrade to IE8 and have IE8 not show the IE7 warning

Related Topic