Warning : The page index.html ran insecure content

Question

I deployed my application on google appe engine. My web site use Dojo with the template claro. When I run "google chrome inspection", I see a lot of warning when I navigate throught my site. Here is the type of warnings :

The page index.html ran insecure content from http://ajax.googleapis.com/ajax/libs/dojo/1.5/dijit/themes/claro/claro.css.
The page index.html ran insecure content from http://ajax.googleapis.com/ajax/libs/dojo/1.5/dojo/dojo.xd.js.

Do I need to configurate something in the appengine-web.xml or web.xml?

Alan Moore · Accepted Answer · 2013-09-12T16:36:33.210

53

If your page is always accessed by secure url (https) then you might try accessing the secure versions of those include files. I think you can just use https: in place of http: in the url for those two files.

If you want to get fancy, you can check to see if the page is secure and pick either the secure or non-secure version of the link. I can post a sample of that if you need it.

Addendum: To save people time, I am posting @mercator's superior solution here:

No need to get fancy. If you want to pick the secure or non-secure version depending on whether your own site is secure, you can use a protocol-relative link. E.g. //ajax.googleapis.com/ajax/libs/dojo/1.5/dojo/dojo.xd.js

edited Sep 12 '13 at 16:36

answered Sep 05 '11 at 14:08

Alan Moore

6,525
6
55
68

70

No need to get fancy. If you want to pick the secure or non-secure version depending on whether your own site is secure, you can use a protocol-relative link. E.g. `//ajax.googleapis.com/ajax/libs/dojo/1.5/dojo/dojo.xd.js`. – mercator Sep 05 '11 at 15:41
Thanks Alan. This saved me as well! – Bitcoin Cash - ADA enthusiast Oct 03 '12 at 03:22
@mercator, you really should write yours as an answer. I found this more than two years later and your answer is the most relavent/helpful – Jason Sep 10 '13 at 18:11
@mercator Change your comment as an answer. Thanks. – Makky Sep 11 '13 at 08:40

wei · Answer 2 · 2013-08-22T14:03:22.677

3

what if the site doesn't support https?? For instance, I'm sending the request to world bank, which only supports http?

EDIT: on chrome, click the "shield" icon on the right of the address bar.

edited Aug 22 '13 at 14:03

answered Aug 22 '13 at 13:39

wei

213
4
13

score 0 · Answer 3 · answered Sep 05 '11 at 14:03

Chrome Inspection validates only client side code, not server side. So, server configuration in appengine-web.xml/web.xml doesn't matter here.

At this case it says that your html is using some external code, from other sites, that can be insecure. It not a big problem, btw. But if you wish, you can copy this files (claro.css and dojo.xd.js) to your own site to fix this issue.

Warning : The page index.html ran insecure content

3 Answers3

Linked