I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images.
If these URLs are
HTTP then the browser does not show the padlock in the URL bar.
What is the best practice for avoiding this?
HTTPS, including URLs inside CSS? (Perhaps, after checking that the resource exists at the
- Rejecting any URL that is not
- Copying the image or CSS (with its referenced images) into my system? (This would mean, for better or worse, that the content would not change as the original does.)