The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [mixed-content]

Browsers warn for mixed content when some resources (e.g. images, scripts or forms) on an HTTPS site is loaded over or posted to HTTP.

Filter by
Sorted by
Tagged with
-2
votes
2answers
133 views

is passive mixed content actually exploitable?

i see everywhere posts of people saying mixed content like images could lead to an attacker replacing the images beeing loaded from http to https, however i couldn't exploit this after hours testing ...
2
votes
1answer
94 views

How do I let users point to their own images, yet avoid Mixed Content warnings?

I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images. If these URLs are HTTP then the browser does not show the padlock in the ...
2
votes
4answers
789 views

Should I be concerned about Wayback Machine trying to load scripts from unauthenticated sources?

I regularly use Wayback Machine to help find archived versions of webpages that have been taken down or are other otherwise unavailable. While using the site, I noticed a peculiar warning in Google ...
6
votes
1answer
2k views

What's the difference between frame-ancestors and child-src?

Both options seem to control who can embed the content in an <iframe> tag, just like X-Frame-Options does. Chrome and Safari are deprecating this header (partially, allow-from for instance), so ...
5
votes
2answers
155 views

Is it safe to submit personal information over a website with a gray (not green) https?

I am required to submit personal information as part of a form. I looked under developer tools and found this:[![screenshot of item displayed in developer tools][1]][1] Mixed Content: The page at ...
0
votes
1answer
41 views

Which HTTPS certificate is the content verified by if the content comes from multiple servers?

If a webserver has an HTTPS certificate and a page on the server pulls resources from other webservers - maybe a CDN with a protocoless path, or not, for things like static images, stylesheets, and ...
4
votes
1answer
634 views

OneDrive marked unsafe by Google Chrome due to unsafe scripts

The OneDrive user's drive page asks to load the following script (which is typically blocked by Chrome to be unsafe) <html> <head> <title>Bing</title> </head> <...
5
votes
1answer
10k views

Mixed Content error in IE11 - HTTPS resource on HTTP page

I have an HTTP webpage with a piece of JavaScript that adds an iframe to the page. The iframe is pointing to an HTTPS page. In the IE11 developer console, this error appears: SEC7111: HTTPS ...
4
votes
3answers
4k views

Why did I see an insecure browser warning on a page with HTTP links?

I noticed that a particular page that is served over HTTPS gets an insecure content warning in both Chrome and Firefox. This seems to be because the page has an anchor with an href property pointing ...
2
votes
1answer
2k views

What benefit does the IE setting “Block unsecured images with other mixed content” provide?

Internet Explorer has the security setting shown in below screen shot. My understanding is that "unsecured images" are images that are not transmitted over HTTPS. What I am curious about is why does ...
0
votes
1answer
13k views

Mixed content - stylesheet being blocked because of a querystring parameter?

I've just run into a scenario where a stylesheet was being blocked on a secure payment page. The stylesheet was loaded like so: <link href="/CSS/all.min.css?v=2" rel="stylesheet" type="text/css" ...
1
vote
1answer
595 views

Can I use a CDN for static content without sacrificing SSL keys?

I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options? An ideal solution would be to link to ...
17
votes
3answers
4k views

Content hashes to help protect resources being fetched from a CDN

During a conversation in The DMZ, it was suggested that an SHA256 hash could be used to check that content being delivered from a CDN hasn't changed before being executed, similar to how Kim Dotcom's ...
3
votes
3answers
664 views

What is the actual security of this login page?

Please visit https://devforums.apple.com If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show. Does this ...
18
votes
5answers
4k views

Why do browsers warn about mixed content for images?

I'm dealing with a phpBB forum user who wants to set up SSL on their entire site to secure user credentials and "private" parts of the website. However, they want to preserve the traditional forum ...
3
votes
2answers
3k views

Do most browsers handle mixed encrypted and unencrypted content correctly?

In Google Chrome, when I go to an encrypted page that contains unencrypted content, I get the following pop-down, which allows me to either load or not load the insecure content, making a clear ...