4 ms·
If you visit a secure site (https), embedding insecure items (http) will fail because they could do just as much damage as loading the entire page over http.
by chipperyman573 10y ago
If you visit a secure site (https), embedding insecure items (http) will fail because they could do just as much damage as loading the entire page over http.
- Buge 10y agoIt depends on what the insecure item is. If it's just an image, it won't fail, it will just grey out the https and not display a lock icon. https://mixed.badssl.com/ https://mixed.badssl.com/
- nailer 10y agoThat's current behavior, but I wouldn't guarantee it will remain that way, an http image compromises the integrity of the site: it could be manipulated to change the meaning. Imagine reading a news site using an unencrypted CDN and whoever runs the WiFi (or the country you're in) is replacing the images with similar yet different ones, giving a different impression that what the creator intended. You could do this quite subtly as a way to influence people by making certain figures appear more sinister. These warnings tend to get tougher over time, so what's grey now may be red next year.