I have a simple question, but can't find the answer that I'm looking for.
Is a http iframe that's loaded on a secure https page also secured?
A iframe with http source will not be displayed on a https website as it's considered mixed content and browsers like Chrome will block the content with the following message:
Mixed Content: The page at 'your website' was loaded over HTTPS,
but requested an insecure resource 'iframe http source '. This
request has been blocked; the content must be served over HTTPS.
So far I have not seen a solution to allow mixed content.
There has been a solution for Firefox which is based on redirecting the iframe source via another website that is hosted on the HTTPS Domain.
It is not automatically, you should verify if the src of your iframe is connecting via https or not:
<iframe src="http://www.example.com"></iframe>
your iframe doesn't extend the https access from principal page.
Related
I am working on a wordpress website, when i load my website from google chrome i found the following errors: Mixed Content: The page at 'https://www.example.com/' was loaded over HTTPS, but requested an insecure font 'http://example.com/wp-content/themes/woodstock/fonts/woodstock/woodstock.woff?421wez'. This request has been blocked; the content must be served over HTTPS. and Mixed Content: The page at 'https://www.example.com/' was loaded over HTTPS, but requested an insecure font 'http://example.com/wp-content/plugins/woocommerce/assets/fonts/star.ttf'. This request has been blocked; the content must be served over HTTPS.
Note: i have another domain name but this is an example
I have tried to install many secured SSL plugin but it doesnt change anything.
Load your font ressources over https instead:
https://example.com/wp-content/themes/woodstock/fonts/woodstock/woodstock.woff?421wez
https://example.com/wp-content/plugins/woocommerce/assets/fonts/star.ttf
Trying to publish HTTPS content (login form) using iframe onto HTTP page.
Have permission, but do not have access to source code of HTTPS page.
Standard attempts to publish iframe do not work with this HTTPS page content.
Appears that HTTPS page x-frame-option set to DENY.
Is there any way to embed/frame/etc. this HTTPS content onto HTTP page despite x-frame objections?
This is a WordPress site. Not sure if that is relevant here.
No there is not, and this actually have nothing to do with HTTP or HTTPS, it's how the X-frame-Options header works.
When a resource returns the header of X-Frame-Options: DENY, it is not possible to show it in any iframe or iframe-like window, not even one on the same site.
You said you have permission though, so perhaps you can get the service you are using to use the ALLOW-FROM option for your service. Something like this could be configured to allow your site to frame it.
X-Frame-Options: ALLOW-FROM https://example.com/
Trying to upload a media (video / image) for iphone and android, from one domain using HTTPs to another HTTP. Cant change both to a single protocol as both have different environments which cant be changed apparently.
Everything's working fine on iOS but Android is not doing the uploading thing.
Getting following error on Android chrome :
Mixed Content: The page at 'https://*****' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://*****'. This request has been blocked; the content must be served over HTTPS.
When the main page is https, then insecure (http) request are mostly blocked.
The best way to avoid mixed content errors is to use https for everything.
I recently installed SSL from CloudFlare Flexible SSL but when I use https it doesn't seem to load image and CSS assets.
I already disabled hotlink protection.
Here are some images to illustrate the difference:
Using https: http://gyazo.com/ef6ccb13c2c8f3f797dcb2d947a772cb
Not using https: http://gyazo.com/be277259e0dcc8e395316b573de12935
Thankful for help!
A look at the browsers console shows lots of messages like this:
Mixed Content: The page at 'https://hornetvault.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://www.hornetvault.com/templates/fresh/assets/css/styles.css'. This request has been blocked; the content must be served over HTTPS.
Which means you try to load resources using http:// inside a https:// site and these resources get blocked. You need to load these resources by https:// too. You might try to simple use // instead of explicitly given http:// or https:// in your URLs, in which case it will simply use the same scheme (http or https) as the page itself.
I've used the following information to get mod_pagespeed to inject the GA scripts into my pages:
https://developers.google.com/speed/pagespeed/module/filter-insert-ga
Unfortunately we have a reverse proxy setup where the browser requests the page over HTTPS but the server injects the content as HTTP.
Here is the Chrome browser error:
[blocked] The page at 'https://*' was loaded over HTTPS, but ran
insecure content from 'http://www.google-analytics.com/ga.js': this
content should also be loaded over HTTPS.
I need this module to use the correct protocol when injecting the script i.e. https:// www.google-analytics.com/ga.js (Sorry for the broken URL I can't post more than 2 links)
We don't have an answer yet, but you can track progress of this bug here: https://code.google.com/p/modpagespeed/issues/detail?id=877
You are going to run into this issue a lot. Try fixing the proxy/server so it correctly identifies the end-user connection as SSL. Most Load Balancers inject a header and have an apache mod to read the header for you.