3

I'm developing a PWA in which part of the app displays the content of emails to the user. However, many of the image URL's that are in the emails come from http domains, and therefore do not load in a PWA (because PWAs only load images that come from https domains).

A Google search revealed that to solve this, I would have to proxy all the images through my domain, so that they would be served over https.

But does that really make my connection any more secure? The image is the only thing loaded over HTTP at the moment, and if I proxyed it through my server, at some point it still has to come from the source server unencrypted (since the image isn't available in https).

I noticed that Gmail does proxy all images. So it seems like there must be some security benefit. I just can't think of what it would be.

3

The problems you will face with "mixed content" are many, and well documented. For instance, see Google's own description.

Some simple examples are:

  • Session cookies may be sent in clear when fetching the image, if it is on the same domain (provided "secure" is not set)
  • Attackers may substitute the content loaded over HTTP with something malicious that executes in the same security context as the content loaded over HTTPS. This is more easily seen for Javascript, but similar problems exist for image formats as well (whether due to bugs or to the formats supporting scripting).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.