I've just run into a scenario where a stylesheet was being blocked on a secure payment page.
The stylesheet was loaded like so:
<link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" />
I was getting an error in the chrome dev console:
Mixed Content: The page at
https://www.example.com/secure/checkout.aspxwas loaded over HTTPS, but requested an insecure stylesheet
http://www.example.com/CSS/all.min.css?v=2. This request has been blocked; the content must be served over HTTPS.
I was under the impression that using relative paths (all.min.css is served locally) would ensure that the content gets served under the protocol of the requested page, in this case
https, but that was obviously not happening.
I tried a few things to get the CSS working again such as using the full path to the file along with
https which didn't work, and on a whim, I decided to remove the 'cache buster' query string
?v=2 and the CSS was served up fine.
That said, I have no idea why this worked, I was unaware that using a query string when referencing a file would prevent it from being loaded securely, could someone explain the reasons for this?
You can verify this yourselves, here are the two links:
Notice the protocol switch in the second link?
Do you think this could have something to do with the SSL still using SHA1? An increased security measure imposed by the browser? I noticed that this doesn't happen in IE but in Chrome/FF, the resource is blocked.