4 ms·
You mentioned community. If you have a forum or message board where people can select their own avatars or post image links, then you'll enjoy the land of mixed
by byuu 10y ago
You mentioned community. If you have a forum or message board where people can select their own avatars or post image links, then you'll enjoy the land of mixed content warnings.
Add the header "Content-Security-Policy: upgrade-insecure-requests" and the mixed content errors will go away, but you'll experience a new problem.
About 30% of images/avatars will break, and of those, roughly 10% of them will cause the page loading animation to keep going for 2-3 minutes before finally timing out. I presume this is due to some sort of server misconfiguration on their part, as most non-HTTPS sites fail fast.
Give it a few months and users will slowly update their avatars and stick to sources that support HTTPS (like imgur), but don't expect the problem to ever go away completely.
- londons_explore 10y agoRun a reverse proxy to host all the user content on your own domain under https instead. Eg. https://yourdomain.com/usercontent/worldofcats.com/foobar.jpg https://yourdomain.com/usercontent/worldofcats.com/foobar.jp... There exist simple php scripts which can do that for you. Beware to sanitize the URL very well, and probably enforce file size rules.
- robryk 10y agoDon't do this on your domain. Have a separate domain for user content (and, if the content isn't public, better have many separate domains and distribute the content between them; maybe even have a per-user domain). Browsers can be convinced that a particular resource is an html page even if the content-type is wrong.