We have an SSL content management (vendor) site that is embedded in salesforce via iframe. The vendor has permalinks for a certain subset of pages. We simply have the full link https://test.com/portals/default.asp?perm=2421. Very simple... User clicks on it in Chrome or FF... boom link doesn't work and spits out the mixed content error below. I know this is a vendor issue but how can a browser detect it is going to an http page when the link is https and the final page they would be take to is https?
Mixed Content: The page at
'https://na2.salesforce.com/servlet/servlet.Integration?lid=01r400000001jzz&…15MHlOVlF4TmpveU1Eb3lNQzR5TlRSYSwxSTVmT0xTdzlpNTQ0c2FTTWdWT1JqLFlXWmtNR0po'
was loaded over HTTPS, but requested an insecure resource
'http://test.com/portals/default.asp'. This request has been blocked;
the content must be served over HTTPS.
You are on an https webpage ( https://na2.salesforce.com ) and try to load an http ressource ( 'http://test.com/portals/default.asp ).
Most browser block it for security reason (even if the http request will redirect to https).
Related
I use UIWebview to load https url, mostly https urls work normal in my app, but some urls make the UIWebview delegate webView:shouldStartLoadWithRequest:navigationType: called twice.
First time, the request parameter has the right https url. Second time, the url in request parameter change to http scheme, this cause the url load failed with error 1022: "The resource could not be loaded because the App Transport Security policy requires the use of a secure connection."
I use Charles to see the network, can not see the https request, means not 320 reqeust, not see the http request either, because the request is block by iOS system, so failed with 1022 code
It's so weird, what the problem is!!!
The https url can be load normal in safari or chrome. I create a new project with only the webview load the https url，It's OK
I am a newbie to Heroku server. I found the default connection method is https.
If I switched to http, I will received the following errors when accessing
No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin *** is therefore not allowed access.
Any idea to enable http access?
The problem here appears to the same-origin policy. Seems that some of your requests are mixed between plain http and https which all modern browsers interpret as having different origins.
Without seeing additional debug information, I'm going to guess the main page is still loaded via https, but the page assets (images, javascript, css etc.) are now loaded via http.
Assuming this is correct, the first step is to ensure the main html page is loaded using the same origin (same domain, same scheme (http or https) etc.).
I'm using sipml5 to connect to a sip phone service and one of the setting is the service websocket server URL. the problem is that the server url is not secured (ex. ws://123.123.123.123:9999/ws) and it cannot be accessed on wss://. Because of that, when loading my site on a HTTPS connection, the browser blocks the request automatically, it doesn't behave like it does when loading let's say, an image over http, and then shows a warning.
Error is: [blocked] The page at 'X' was loaded over HTTPS, but ran insecure content from 'ws://....': this content should also be loaded over HTTPS.
I need to know if there is a way to make the browser connect to ws:// even though the page initializing the request is loaded over https.
Please help.
EDIT:
What I'm looking for is a flag or something like that, in Chrome or Firefox for example, which lets the user access insecure resources even though the page is loaded on https.
Why you are using http? You can get an ssl certificate from https://letsencrypt.readthedocs.org/en/latest/intro.html
then add the following details to http.conf
tlsenable=yes
tlsbindaddr=0.0.0.0:8089
tlscertfile=/path-to/cert.pem
tlsprivatekey=/path-to/privkey.pem
My page is on https but the API url I am calling in AJAX is on http.
I am unable to get the AJAX response.
Mixed Content: The page at 'https://localhost:8443/examples/demo.html' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://www.earthtools.org/timezone-1.1/40.71417/-74.00639?_=1431270529277'. This request has been blocked; the content must be served over HTTPS.
How can I resolve this?
The HTTPS version of API does not exist. How can I still call from my HTTPS enable page. I want my page to be HTTPS it is very important.
Any help?
I had a similar issue where I was on HTTP and had to call an API on HTTPS.
For me disabling the Website tracking i.e. uncheck the Prevent cross-site tracking worked.
I fixed it by using this chrome extension and then reloading my page. it works. https://chrome.google.com/webstore/detail/allow-control-allow-origi/nlfbmbojpeacfghkpbjhddihlkkiljbi?hl=en
Other option is to turn on Proxy and then use it,
https://chrome.google.com/webstore/detail/zenmate-security-privacy/fdcgdnkidjaadafnichfpabhfomcebme?hl=en
I'm getting this error when trying to make an ajax request in a custom module:
XMLHttpRequest cannot load https://www.vossmarket.com/index.php/shoppinglist/index/showLists/product/4294/form_key/6erZKqom1ynOWDKI/qty/1/. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://www.vossmarket.com' is therefore not allowed access.
I'm assuming the problem is that I am calling https from the http, but I'm not able to figure out why it is calling the https. I've turned off https in the magento config (I changed secure_base_url to http://vossmarket.com and I turned Use Secure URLs in Frontend to "no"). Now all links stay http, but when I visit my custom module, it is still redirecting (302) to https. This happens to every link http://vossmarket.com/shoppinglist (my custom module), any other route stays http, but any route that hits my module in any ways 302s to https
Any ideas what might be happening or the best way to fix it?
Have you tried putting a file called crossdomain.xml in your web root (accessible by both http and https), ie at http(s)://vossmarket.com/crossdomain.xml
This should help define that cross site origin is allowed between http and https.
In your case, I think the custom module is upset about being accessed over http and is sending the 302 to your browser, so it would be a case of studying the controller action of the custom module to figure out why it is forcing https (instead of asking Magento what the secure URL is).
Actually, if you try this crossdomain.xml you will need the browser to request https out of the http loaded page otherwise I think you will still get the 302 redirect - but with crossdomain.xml in place you should be able to XMLHttpRequest from http://vossmarket.com to https://vossmarket.com
But, you know, often there is good reason for https so I think you should understand why https is being forced and also I don't know about that XML secure="false" - does it really mean an https request is returned over http? I hope not but I don't know.
For more information read up on CORS although your 'cross domain' is http crossing to https.