Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have properly configured SSL, and it loads pages when you put https. My problem is that when the page is loading. The bar will turn green, once the page is fully loaded. The green bar goes away. The url stays as https. I have checked all items on the page for any NON-https items and I couldn't find any.

The site url is: www.jlucina.com.

Why does the bar turn green then go away after the page fully loads?

UPDATE: It seems to work on chrome for the most part. If I continue shopping and add another item it breaks. So weird.

I have confirmed that it is a mixed content issue because I used a plugin that disables all images on the site and it stays green when I do that. I can't find WHICH image is causing the issue.

share|improve this question
    
What browser are you observing this in? –  B-Con Aug 23 '12 at 16:15
    
Firefox at the moment. Haven't gotten around to cross browser testing it yet. –  Digital Fire Aug 23 '12 at 16:18
4  
Perhaps mixed content –  CodesInChaos Aug 23 '12 at 16:22
    
Yes, I'm checking for that but can't find WHAT is the item that is non-https. Do url targets count? –  Digital Fire Aug 23 '12 at 16:23
1  
If I try jlucina.com I get a 302 redirect to jlucina.com HTTP/1.1 302 Found ... Location: http://www.jlucina.com/ –  dr jimbob Aug 23 '12 at 16:24

1 Answer 1

up vote 6 down vote accepted

The problem is that you sometimes refer to https resources by https://jlucina.com; for example one image is located at: https://jlucina.com/sites/default/files/pin.png

Now your web site is setup that https://jlucina.com 301 redirects to http://www.jlucina.com, so despite the https in the source the resource is sent unencrypted over the network, so you get the partially encrypted warning in firefox. So if you try going to https://jlucina.com/sites/default/files/pin.png you end up at http://www.jlucina.com/sites/default/files/pin.png which is your mystery unencrypted media resource.

You can use curl to see the http response headers:

$ curl -I https://jlucina.com/sites/default/files/pin.png
HTTP/1.1 301 Moved Permanently
Date: Thu, 23 Aug 2012 10:15:05 GMT
Server: Apache
Location: http://www.jlucina.com/sites/default/files/pin.png
Cache-Control: max-age=1209600
Expires: Thu, 06 Sep 2012 10:15:05 GMT
Connection: close
Content-Type: text/html; charset=iso-8859-1

I got to the bottom of this by using a tool like firefox's web console, seeing what's sent over the network on port 80 (facebook.png, twitter.png, pin.png) and then going back to the page, seeing how/where they were referenced and eventually figuring out https://jlucina.com differed from other https links and used curl to check the headers of the request.

share|improve this answer
1  
Good detective work, dr jimbob! :) –  Polynomial Aug 23 '12 at 19:47
1  
+1 for the answer and if curl/wget and strace fail there's always tcpdump/wireshark to figure out what the clients and servers are actually saying to each other (up to a point) –  adric Aug 23 '12 at 19:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.