CODEWITHSUNDEEP
c#asp.net-mvcrecaptchamvcrecaptcha
Beginner
Beginner

Reputation: 29573

PoliteCaptcha Https Issue MVC Razor

I am using PoliteCaptcha as follows: 

<div class="form-container"> 
@using (Html.BeginForm("LogOn", "Account", new { ReturnUrl = Request.QueryString["ReturnUrl"] }, FormMethod.Post, new { id = "formLogOn" }))
{
  @Html.TextBoxFor(model => model.UserId, new { id = "textBoxUserId", placeholder="Enter your username" })<br />
  @Html.ValidationMessageFor(model => model.UserId)<br />

  @Html.PasswordFor(model => model.Password, new { placeholder="Enter your password" })<br />
  @Html.ValidationMessageFor(model => model.Password)<br />

  @Html.SpamPreventionFields()

  <input type="submit" id="ButtonLogOn" value="LoginButton" class=" button" />
}
</div>
<div id="validationSummary">
    @Html.Partial("_AjaxValidationSummaryPartial")
</div>

@if (Model != null && !Model.ShowCatcha)
{
  @Html.SpamPreventionScript()
}

This works fine but not when it goes live on a https domain. I get error:

Mixed Content: The page at 'https://www.domain.com/log?ReturnUrl=%2Fadmin' was loaded over HTTPS, but requested an insecure script 'http://www.google.com/recaptcha/api/challenge?k=6LcAAAAOQuMiKA-yCo4HZPp4gy-T0x7CaX'. This request has been blocked; the content must be served over HTTPS.

Upvotes: -1

Views: 761

Answers (2)

JJS
JJS

Reputation: 6678

It's very possible that you're behind a reverse proxy, and the api that RecaptchaControl uses to generate the scripts is not detecting Context.Request.IsSecureConnection correctly. Could you let us know what value Context.Request.IsSecureConnection returns?

https://code.google.com/p/recaptcha/source/browse/trunk/recaptcha-plugins/dotnet/library/RecaptchaControl.cs#358

@Html.SpamPreventionFields() is an IHtmlString, so you could just create a page variable and do some String.Replacing on it...

@{
var preventionFields = Html.SpamPreventionFields().ToHtmlString().Replace("http:", "https:")
}

and in your form

@Html.Raw(preventionFields)

Upvotes: 0

Vincenzo
Vincenzo

Reputation: 1559

You're requiring insecure content from a secure connection, and this is usually strongly discouraged.

I checked PoliteCaptcha source code and there is no reference to JS file; for this reason it should be very easy to fix.

Locate your script tag and simply delete the protocol prefix.

Change this

<script src="http://www.google.com/recaptcha.js

To this

<script src="//www.google.com/recaptcha.js

The browser will figure out automatically the protocol to use, and get rid of the problem.

Upvotes: 1

Related Questions