0

We have a container site which implements HSTS and a video sharing site which is using HTTP only and doesn't have TLS implemented, nor will it.

How does one avoid mixed content in container site and keep the security on if it has the resource video from the video site embedded in it? I understand that this is exactly what HSTS tries to fix but I'm trying to understand how we can impose such strict security if we're dependent on some external resources that run insecurely.

1

Mixed content is not really related to HSTS. It happens whenever you embed unprotected content into a protected (HTTPS) site. To avoid the mixed content error you need to avoid serving mixed content in the first place, i.e. don't embed HTTP content into a HTTPS site.

  • The preferred way is to embed the content from the original server with HTTPS.
  • If this is not possible your own server might need to proxy this traffic so it gets served as HTTPS - see How to allow http content within an iframe on a https site and Is it possible to proxy remote content on HTTPS page?. Note that it can be pretty dangerous to simply forward the requests to your site to some other site and forward the response back - you should at least sanitize the request and response and remove any cookies. Even better might be to use a different domain (which you control and which serves HTTPS) to keep the request cross-origin.
  • The worst option is probably to disable HTTPS on your site too in order to embed HTTP content from a remote site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.