sometimes when I am on this site my firefox shows the lock with a gray triangle, that means it blocked active mixed content (javascript over plain HTTP). can you check what’s going on?

I don’t get the problem… Images from posts are mirrored locally and consequently served through HTTPS. I’ve never seen a mixed content warning and by the lack of other users posting and complaining in this topic, you seem to be the only one?

not an image from a post but from a onebox. and it gets worse when in some cases when the whole site is included then I even get an “active content blocked” message.

Can you please provide the link to an sample so that we can check it ?

mixed passive content is right in our private conversation where you posted an amazon link the onebox has an HTTP image in it.

So here is an sample: [image] Amazon.com: PIVKey T800 USB Authentication Token (PKI Smart Card): Computers & Accessories The PIVKey T800 provides a PIV (SP 800-73) smart card in the form of a tiny USB token. Only 3/4 inch long, this USB token is ideal for mobile applications, and for us…

Well, that’s just plain stupid by the poster of that URL… If you use https://, nothing would be wrong. :stuck_out_tongue: Furthermore, the only other option would be the disabling of previewing content altogether… So yes, perhaps sometimes you won’t get the green lock icon… I don’t see why this sho…

yeah this disabliing of iframing whole pages would be nice. also I tried to call that page over HTTPS but it somehow just downgraded the connection to HTTP. is that even possible?

The site from the misued cert thread indeed downgrades to HTTP… And yes, why shouldn’t this be possible? If you can redirect a non-HTTPS to HTTPS, why wouldn’t you be able to do the same the other way around? My remark was for Amazon, they do HTTPS finely.

well except for that image in the onebox. well I thought there are downgrade protections everywhere and I see no reason to downgrade, I mean if you go through the trouble of getting a cert in the first place then use it.

Mixed active content

Site Feedback

My1 January 23, 2016, 9:14pm 13

and as I said in the misused certificates thread ( Misused certificates ) there is right at the first post a whole page iframed and that has an HTTP javascript which obviously from the mixed active flag.

Topic		Replies	Views
LE Community Unsecure? Site Feedback	18	1274	November 29, 2020
Security risk of embedding an https iframe in an https page with a lightbox Help	5	2443	August 3, 2017
Mixed content blocked Help	2	2128	November 29, 2023
Movement to Expand the Definition of Mixed Content Feature Requests	16	1311	June 10, 2021
Successfully installed but frontend still displays:unsafe Help	3	708	September 7, 2018

Mixed active content

Related topics