5

I have installed a (non wildcard) SSL certificate so my website can use HTTPS. When I try to request resources from HTTP urls I get error-message like:

Mixed Content: The page at 'https://example.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://resources.example.com/style.css'. This request has been blocked; the content must be served over HTTPS.

I get that it probably is a bad practice according to all kinds of opinions people might have when it comes to mix http and https, but I only ask for static resources that I don't regard as critical over http.

Tried to google "allow http requests from https with iis" and similar, but can't find a clear answer. Is there a way around this, is it solvable the same way CORS is?

Sorry if the question isn't very smart and if the answer is obvious, but I lack quite some knowledge some when it comes to networking stuff.

Adrian Rosca
  • 6,922
  • 9
  • 40
  • 57

1 Answers1

5

stylesheet ... static resources that I don't regard as critical over http.

CSS can include script and script can alter the page, so it is considered critical.

..."allow http requests from https with iis" ...

The decision to deny mixed content is done within the browser. There is no setting which will allow the browser to include mixed content. The behavior on what is considered mixed content differs between browsers and versions, look here for more information from a year ago.

... is it solvable the same way CORS is?

The security model of CORS cares about same origin policy and a server may decide that a specific other side might do a CORS request. But in this case it is the question if the content might be modified in transit by anybody (i.e. man-in-the-middle attack).

Steffen Ullrich
  • 114,247
  • 10
  • 131
  • 172
  • That made it clearer Steffen. Good link too, especially the part where it says "A single exposed script is sufficient: the attacker can hijack the connection and inject arbitrary attack payloads into it". Quite convincing =) – Adrian Rosca Apr 24 '15 at 18:55
  • This answers the question, but might be better to include the how as well. Can we update answer? – Urasquirrel Jul 17 '19 at 16:54
  • 1
    @Urasquirrel: There is no "how". To cite myself *"There is no setting which will allow the browser to include mixed content."*. – Steffen Ullrich Jul 17 '19 at 17:31