0

I have several websites (*.cshtml pages, since this is Umbraco). In some of my pages under Umbraco, I'm getting the following errors in the chrome console:

Mixed Content: The page at 'https://www.myDomain/umbraco/refresh.aspx' was loaded over HTTPS, but requested an insecure script 'http://www.myDomain/WebResource.axd/?d=nv7asgRUU0tRmHNR2D6t1MIDlVwErV_OMFfS4XKOzVy5hbyYSqjQBBsVpxfy8CPStvqW2QAUTJbrrf7GkkAAdiPAOpeRljfK_88DWE7H1L6TrQaDUbdxsR71i0K1vkfZXf93noBTUfQtz7fnJLAQ-w2&t=ffffffffcdd1bd0a'. This request has been blocked; the content must be served over HTTPS.

and also

Mixed Content: The page at 'https://www.myDomain/umbraco/refresh.aspx' was loaded over HTTPS, but requested an insecure script 'http://www.myDomain/ScriptResource.axd/?d=D9drwtSJ4hBA6O8UhT6CQvh2ZcleftUQ1Y_l0ZcDxaRLYMsTaSEKp8Vs8KW-6sEEoRYsD2yHXR9jx29tO_zmuUkq265RLO8kL417ZWYrVCTWiFV3V9AIVK3_wnAJENNtrU2Wmv-QGduBSHYy6FDVdGMmDavZtI9hgttbjWcObxo1&t=ffffffff9a9577e8'. This request has been blocked; the content must be served over HTTPS.

I have two more sites, with exactly the same code, that does not have this issue. My guess is a URL rewrite I'm missing (or that is redundant), OR that I have a missing web.config verb.

What i've tried so far:

  • Adding missing verbs to config file
  • Tried to explicitly include *.axd files in my HTTP to HTTPS already existing rule (maybe I've done it wrong?)
  • Tried to add mime types

nothing worked.

I'm sure it has to with URL rewrite.

Thanks,

Rotem

Rotem Orbach
  • 132
  • 1
  • 13
  • Not exactly. As far I understand in your case browser sends requests to non-secure url and blocks its content even in case of redirect to https. As you mentioned, you have exactly the same instance that works, so "ssl off-loading" can be the reason of the current issues. In this case Umbraco knows nothing regarding secure connection because it's established earlier (before Umbraco) in request pipeline. So Umbraco will generate urls on server-side using non-secure http protocol. Relative urls could resolve the issue. – malonowa May 28 '20 at 14:21
  • Are you requesting the backoffice (/umbraco/ ) in https? Try set this in web config: In Umbraco V7 In Umbraco V8 – Eyescream May 29 '20 at 14:22
  • Hi @malonowa. Thank you for your answer. Not sure how can I use relative url's here? these handler files (webresource.axd and ScriptResource.axd) are not url's I can control. They are genegrted on the fly. Can you please elaborate? – Rotem Orbach May 30 '20 at 09:11
  • I am not familiar with umbraco 4. But if you control all content on your website, then you can try to use this approach to tell browser to use https: https://forums.asp.net/t/2148272.aspx?webresource+axd+causing+SSL+issues – malonowa May 30 '20 at 11:29

0 Answers0