CODEWITHSUNDEEP
securityweb
Alf Eaton
Alf Eaton

Reputation: 5463

Can HTTPS web pages be permitted to load data over HTTP?

If a web page that's only served over HTTPS tries to load data (e.g. JSON) that's only available over "insecure" HTTP, Chrome blocks the request with a message that "This page is trying to load scripts from unauthenticated sources".

Is there a meta tag that can be added to the HTML page to override this, allowing the data to be loaded?

Upvotes: 1

Views: 47

Answers (1)

Neil McGuigan
Neil McGuigan

Reputation: 48256

This is up to the browser and user now. It's not something you should try to disable.

Here's what you can do:

  1. Change your external URLs to https if the external servers support it

  2. Copy external scripts and serve them from your local server, if possible

  3. If the above are not possible, you will need to setup a reverse proxy and serve them from there. Ex. if external content is at http://external.com/script.js , then change the URL to https://me.com/proxy/external.com/script.js, and have your proxy grab the insecure content and return it as required.

Upvotes: 1

Related Questions