4 ms·
This would be fine, if only more third party resources were available over HTTPS at a reasonable cost. For instance, I'd love to use Olark for occasional custo
by callahad 15y ago
This would be fine, if only more third party resources were available over HTTPS at a reasonable cost.
For instance, I'd love to use Olark for occasional customer support queries, and the free plan would work great for now. Unfortunately, Olark doesn't offer SSL until their $49/month plan.
Similarly, Cloudmade's fantastic OpenStreetMap tileserver is only available over plain HTTP, period.
With this change, I would have to choose between great services like Olark or CloudMade and offering SSL everywhere on the site. I understand that select pages with mixed content could be subject to man-in-the-middle attacks, but surely that's a better risk profile than forcing me to run everything over HTTP, right?
- nl 15y agoWhy is this getting downvoted? It's a huge, common issue. For example, Yahoo's AJAX libraries serve via HTTP, and it doesn't work over HTTPS. See, for example https://yui.yahooapis.com/combo?2.9.0/build/yahoo-dom-event/yahoo-dom-event.js&2.9.0/build/animation/animation-min.js https://yui.yahooapis.com/combo?2.9.0/build/yahoo-dom-event/...
- stoney 15y agoI got around the problem of needing to show data from a non-SSL map server on an https site by using reverse proxying. So my javascript requests the map tiles from a URL on my site (over https), the server then forwards the request to the real map server. That should work for Cloudmade's map server. Not sure if you could do that with Olark.
- wladimir 15y agoThat's indeed an issue at the moment. Hopefully it is a temporary problem, as decisions such as this will nudge services towards supporting https.