5

I'm currently build my website and I face a problem the Mixed Content blocking in JavaScript which occur with Chrome, Mozilla and Explorer when I tried to load and display image and page coming from http request which I had built it with JavaScript.

I would like to know if there is a code that I could add in my JavaScript code to allow the Mixed Content with my browser? That means just allow my content to be displays without change the configuration of my browser. Thx

gerard talla
  • 165
  • 2
  • 3
  • 8
  • Consider what would happen if the answer was "yes". Lots of sites would do this (rather than fix their links/servers), and man in the middle attacks would be much easier against apparently secure pages. – Richard Mar 19 '18 at 14:53

1 Answers1

5

No.

The only thing you can do is to serve everything from HTTPS, or (not recommended) downgrade the top-level site to insecure HTTP.

The script is disabled, because an attacker could put anything in there. If that anything could include "trust me, I'm safe", then an attacker could put the same on their exploit.

As a side note: all browser vendors are 100% serious about completely deprecating insecure HTTP on the web — no ifs, no buts, no exceptions. You'll save yourself pain if you accept that http:// is no longer usable, and switch everything to be served via HTTPS. There's Let's Encrypt/certbot, CloudFlare, and AWS that can make your site HTTPS with little hassle, for free.

Kornel
  • 97,764
  • 37
  • 219
  • 309