5

In a PHP site I request images (user profile photos) from a PHP file, the image are loaded explicit using HTTPS as the entire site where HSTS are enabled.

The problem is that the site gives a "Mixed content" warning in Chrome and Firefox even though not a single asset are loaded using HTTP - all are either relative or explicit HTTPS in the sourcecode.

When I look at the network tab in Chrome developer tools, I can see that the image are initially requested using HTTPS but then a internal redirect 307 using HTTP are made, and finally the image are retrieved using HTTPS. HTTP request in Chrome network tab

The PHP file that returns the image has the request routed by index.php and .htaccess using a simple rewriterule

RewriteRule ^([^/.]+)/([^/.]+)/?$     index.php?action=$1&data1=$2  [L,QSA]

And the PHP file are very simple as well

if(!isset($_GET["f"]))die("filepath missing");
$file = APP."/filecache/".$_GET["f"];
if(file_exists($file)){
  if(substr($_GET["f"],-3)=="jpg") Header("Content-Type: image/jpeg");
  if(substr($_GET["f"],-3)=="png") header("Content-Type: image/png");
  header('Cache-control: max-age='.(60*60*24*365));
  header('Expires: '.date("Y-m-d H:i:s",strtotime("+365 days")));
  header('Last-Modified: '.gmdate(DATE_RFC1123,filemtime($file)));
  readfile($file);
}else{
  die("no such file");
}

The webapp works "fine" but the mixed content warning really frustrates me, so I would really appreciate any pointers or ideas that might work.

The site is running on a DO VPS, Apache/Nginx with PHP-FPM 7.1.

Kind regards and happy holidays, Mark

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Mark
  • 61
  • 1
  • What happens when you visit the redirecting URL directly? You might want to enable log preservation in the Chrome developer tab to see what happens. – Tom Udding Dec 19 '18 at 08:48
  • When I access the image directly I don't see the 307 redirect and only 1 request for the image, compared to 3 for each in the above question. – Mark Dec 19 '18 at 09:37

1 Answers1

0

I do not know why the redirect from https falls back to http. I would work around using a RewriteRule with absolute URI including the scheme, e.g.:

RewriteRule ^([^/.]+)/([^/.]+)/?$  https://%{HTTP_HOST}/index.php?action=$1&data1=$2  [L,QSA]

I did not try that line in my .htaccess as I do not have such a use case, so please try yourself if this fits.

martin_s_007
  • 1
  • 1