6 ms·

Identify HTTPS Mixed Content Issues In Real-Time

15 points by stilliard 10y ago

teach 10y ago
I've read 3 or 4 pages on the site, and it's still not clear to me what this tool purports to do. It identifies mixed-content "issues". What does that mean? How is it different from the sort of information I get from Qualys SSLLabs' server test?
- iancarroll 10y ago
  It sounds like it identifies cases where a secure site attempts to load insecure images, JS, etc (aka mixed content). SSL Labs tests a hostname and the strength of the connection offered by the server, but not if that page attempts to load mixed content.
- vtlynch 10y ago
  Mixed Content is when your site is serving some of the page's content over HTTP, and some over HTTPS. This is a problem because if any piece of content is served over HTTP, browsers will count the connection as non-secure and will not display the "green padlock". This is a pretty common problem when it comes to HTTPS deployment. Normally seen with sites that were deployed/designed without any consideration for HTTPS. Hardcoded URLs, third-party services that don't offer HTTPS, absolute protocol links, and big clunky infrastructure are the most common causes. Qualy's SSL Labs does not address this. It looks at the site's SSL configuration, not the way content is served. SSL Labs helps you know if there are any issues with your certificate (old signature algorithm, common name mismatch, self-signed, certificate chain issues, etc) and crypto settings (ciphers, protocol version, etc).
  - teach 10y ago
    I know what mixed content is. I guess because all my websites are static, I never needed anything fancier than: grep -e "http:" *.html
newsat13 10y ago
Would it not be better if I can run this test locally instead of a service?
- tomschlick 10y ago
  The value is that it runs constantly in the background to pick up issues without humans having to run the tool every few months.
  - carwyn 10y ago
    That's called a cron job.
jwcrux 10y ago
This doesn't really explain what it's checking, but if you're looking for an actual checker for your HTTPS configuration, Qualys SSLLabs maintains an open source client [0] that could easily be scripted to do this exact thing. [0] - https://github.com/ssllabs/ssllabs-scan/ https://github.com/ssllabs/ssllabs-scan/
- rascul 10y ago
  also exists https://testssl.sh/ https://testssl.sh/ which can be quite useful but maybe not for automating
- weddpros 10y ago
  You might also like https://sslping.com https://sslping.com : it monitors your servers for free (sends emails if bad cert/ciphers/protocols). Shameless plug, it's my side project, started because monitoring beats point in time checks.
finnn 10y ago
Doesn't a CSP catch and report mixed content issues?
- seanhunter 10y ago
  A csp can say that you only want to load things over https and Strict-transport security (HSTS) also helps here (see https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ). I've found http://securityheaders.io http://securityheaders.io quite helpful in securing my servers alongside ssl labs server test (as others have mentioned) to check that your actual server and SSL certs are configured well.
  - finnn 10y ago
    According [0] CSP can do it and offers reporting, unlike HSTS. [0]: https://scotthelme.co.uk/fixing-mixed-content-with-csp/ https://scotthelme.co.uk/fixing-mixed-content-with-csp/
- jusob 10y ago
  CSP is not supported by IE, unfortuantely. But you an do 2 things around HTTPS: * set up a report-only policy saying taht all assets must be loaded over HTTPS. You can receive a report when this is not the case. * use upgrade-insecure-requests to upgrade HTTP requests to HTTPS automatically. Obviously, this can break stuff if the 3rd party server does not supprot HTTPS or has invalid SS certificates (CDN, for example). Most browsers load images over HTTP from a HTTPS site but they will not for active content (Javascript, IFRAMES, etc.) unless the user explicitly acknowledge the mixed-content issue.
p4bl0 10y ago
The title is misleading. This is not an article explaining how to get HTTPS security right, it is the landing page for a paid service.

15 points by stilliard 10y ago

teach 10y ago

I've read 3 or 4 pages on the site, and it's still not clear to me what this tool purports to do. It identifies mixed-content "issues". What does that mean? How is it different from the sort of information I get from Qualys SSLLabs' server test?

iancarroll 10y ago
It sounds like it identifies cases where a secure site attempts to load insecure images, JS, etc (aka mixed content). SSL Labs tests a hostname and the strength of the connection offered by the server, but not if that page attempts to load mixed content.
vtlynch 10y ago
Mixed Content is when your site is serving some of the page's content over HTTP, and some over HTTPS. This is a problem because if any piece of content is served over HTTP, browsers will count the connection as non-secure and will not display the "green padlock". This is a pretty common problem when it comes to HTTPS deployment. Normally seen with sites that were deployed/designed without any consideration for HTTPS. Hardcoded URLs, third-party services that don't offer HTTPS, absolute protocol links, and big clunky infrastructure are the most common causes. Qualy's SSL Labs does not address this. It looks at the site's SSL configuration, not the way content is served. SSL Labs helps you know if there are any issues with your certificate (old signature algorithm, common name mismatch, self-signed, certificate chain issues, etc) and crypto settings (ciphers, protocol version, etc).
- teach 10y ago
  I know what mixed content is. I guess because all my websites are static, I never needed anything fancier than: grep -e "http:" *.html

newsat13 10y ago

Would it not be better if I can run this test locally instead of a service?

tomschlick 10y ago
The value is that it runs constantly in the background to pick up issues without humans having to run the tool every few months.
- carwyn 10y ago
  That's called a cron job.

jwcrux 10y ago

This doesn't really explain what it's checking, but if you're looking for an actual checker for your HTTPS configuration, Qualys SSLLabs maintains an open source client [0] that could easily be scripted to do this exact thing. [0] - https://github.com/ssllabs/ssllabs-scan/ https://github.com/ssllabs/ssllabs-scan/

rascul 10y ago
also exists https://testssl.sh/ https://testssl.sh/ which can be quite useful but maybe not for automating
weddpros 10y ago
You might also like https://sslping.com https://sslping.com : it monitors your servers for free (sends emails if bad cert/ciphers/protocols). Shameless plug, it's my side project, started because monitoring beats point in time checks.

finnn 10y ago

Doesn't a CSP catch and report mixed content issues?

seanhunter 10y ago
A csp can say that you only want to load things over https and Strict-transport security (HSTS) also helps here (see https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ). I've found http://securityheaders.io http://securityheaders.io quite helpful in securing my servers alongside ssl labs server test (as others have mentioned) to check that your actual server and SSL certs are configured well.
- finnn 10y ago
  According [0] CSP can do it and offers reporting, unlike HSTS. [0]: https://scotthelme.co.uk/fixing-mixed-content-with-csp/ https://scotthelme.co.uk/fixing-mixed-content-with-csp/
jusob 10y ago
CSP is not supported by IE, unfortuantely. But you an do 2 things around HTTPS: * set up a report-only policy saying taht all assets must be loaded over HTTPS. You can receive a report when this is not the case. * use upgrade-insecure-requests to upgrade HTTP requests to HTTPS automatically. Obviously, this can break stuff if the 3rd party server does not supprot HTTPS or has invalid SS certificates (CDN, for example). Most browsers load images over HTTP from a HTTPS site but they will not for active content (Javascript, IFRAMES, etc.) unless the user explicitly acknowledge the mixed-content issue.

p4bl0 10y ago

The title is misleading. This is not an article explaining how to get HTTPS security right, it is the landing page for a paid service.