4

The OneDrive user's drive page asks to load the following script (which is typically blocked by Chrome to be unsafe)

<html>

<head>
    <title>Bing</title>
</head>

<body>Loading...
    <script type="text/javascript">
        //<![CDATA[
        var _w = window;
        var o = _w.opener;
        var mainWindow;
        (mainWindow = o) || (mainWindow = _w.parent);
        if (mainWindow) {
            mainWindow.sj_evt && mainWindow.sj_evt.fire("wl:auth");
        };
        if (o) _w.close();;
        //]]>
    </script>
</body>

</html>

And the following was logged in the Developer Console

AI session renewal date is 0, session will be reset.
Mixed Content: The page at 'https://onedrive.live.com/?cid=<REDACTED>' was loaded over HTTPS, but requested an insecure form action 'http://www.bing.com/Passport.aspx?popup=1'. This request has been blocked; the content must be served over HTTPS.
Mixed Content: The page at 'https://onedrive.live.com/?id=root&cid=<REDACTED>' was loaded over HTTPS, but requested an insecure form action 'http://www.bing.com/Passport.aspx?popup=1'. This content should also be served over HTTPS.
Uncaught SecurityError: Blocked a frame with origin "http://www.bing.com" from accessing a frame with origin "https://onedrive.live.com".  The frame requesting access has a protocol of "http", the frame being accessed has a protocol of "https". Protocols must match.

Can anyone shed some light on what it's exactly doing? Is OneDrive not secure anymore, or is this a false positive by Chrome?

2

I'm not a big-time expert on this. But I can give you a small explanation with my 3year as a server admin and technologist to a web development company.

The script may be a unified login check like Google does for all of its products.

The reasons for chrome to report it as unsafe are - It is being loaded over HTTP not HTTPS. - The requested script or page is from another domain (Bing.com) not the same or subdomain of the domain live.com.

So don't worry thinking that Google Chrome has detected one drive as harmful. It is just about the content being loaded from a different site and a non HTTPS URL.

| improve this answer | |
  • 1
    Well why would Microsoft even still be using HTTP then :/ – Paras Dec 25 '15 at 18:25
  • 2
    @ParasDPain Because it can be hard to spot every script being loaded if the framework doesnt support dynamic protocols. – James Cameron Dec 25 '15 at 21:48
  • 2
    @ArunAnsonArouje It only checks for HTTP / HTTPS, it doesnt matter if the domain is the same. – James Cameron Dec 25 '15 at 21:49
  • @JamesCameron is correct. But in just a security perspective, content from another domain may be a security threat. But here in the case of the error in developer console, its not the domain. It's just the HTTPS that matters. :) – Arun Anson Dec 26 '15 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.