HTML5: Playing HTTP streaming on HTTPS domain

Question

Can I play HTTP streaming on HTTPS domain without browser's security errors? The browser blocks that requests by default.

I use hls.js library for .m3u8 desktop playing support. When I play content natively without it (via mobile or Mac's Safari), the browser shows warning but doesn't blocks requests. But when I play it on same devices with hls.js enabled, or via desktop browsers, the requests are blocked.

Answer 1

You can't.

Mixed content, when you have resources served over http on a https site, can be passive or active.

Passive:

• Images
• Videos
• Audio

Active:

• Javascript
• CSS
• iFrames
• Objects (flash, etc.)
• XHR (requests made with javascript)

The problem is that your video is fetched with hls.js, which is considered active content (see that last bullet), and therefore blocked.

However, if the browser fetches it through a <video> element, it is considered passive content and allowed.

Suggestions / workarounds

• Switch your video servers to HTTPS. This is the preferred option. HTTPS is faster. You said that your server's administrator says that the HTTPS will "overload videoservers". I doubt that. Try it out and see.

  If you stop reading now you only need to remember one thing: SSL/TLS is not computationally expensive any more. -- Adam Langley (Google)

• Switch to a diffrent video format, like mp4 or ogg or load both. Your website will load faster because you don't need a library.
• Switch to http DON'T DO THIS