Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protocol-Relative URLs to Fix Mixed-Content Warnings

autoref.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Protocol-Relative URLs to Fix Mixed-Content Warnings

#11

Post by bgmd »

The problem this DOESN'T solve is that if the resource is not availale over SSL, then this won't work at all and will show broken links.

I've got a project that addresses this by converting any URL to SSL:

  http://www.fixweb.co/
Just take whatever URL you want to access, like

  http://example.com/test.gif
add the FixWeb.co address in front of it like this:

  https://fixweb.co/example.com/test.gif
  ^^^^^^^^^^^^^^^^^^
and it will return the file over SSL.

It's not designed for high security file delivery, obviously, but it will get you around a normal Mixed-Content warning.

Re: Protocol-Relative URLs to Fix Mixed-Content Warnings

#13

Post by RKearney »

zenazn wrote: post #4

...or you could request all your resources over SSL.

No no no! Unless you absolutely need your content encrypted, all this does is add unnecessary latency to your site for the SSL handshakes. If your site hosts zero external content, and all of your content is hosted from the same domain, this wouldn't be as big of an issue. However, most sites host content from 4-5 different domains, which means you're going to have 4-5 different SSL handshakes, thus resulting in a much slower page load.

Re: Protocol-Relative URLs to Fix Mixed-Content Warnings

#15

Post by eli »

lukeasrodgers wrote: post #12

For what it's worth, the research I'm aware of on whether users actually notice or care about mixed content warnings suggests that they generally neither notice nor care: http://www.usablesecurity.org/emperor/ .

Sure, most people will ignore security warnings, but I still really, really don't want my site to ever pop up security warnings.

Re: Protocol-Relative URLs to Fix Mixed-Content Warnings

#17

Post by throwaway64 »

Jare wrote: post #7

I thought the Chrome browser had recently started to block insecure content loaded from https pages; it does for me and I don't remember changing some related settings recently. Anyway yeah, it's very sane advice.

it did, temporarily in the beta, however so much of google's own stuff had this issue (especially adwords), they scrapped the idea.

Re: Protocol-Relative URLs to Fix Mixed-Content Warnings

#18

Post by fotbr »

RKearney wrote: post #13
zenazn wrote: post #4

...or you could request all your resources over SSL.

No no no! Unless you absolutely need your content encrypted, all this does is add unnecessary latency to your site for the SSL handshakes. If your site hosts zero external content, and all of your content is hosted from the same domain, this wouldn't be as big of an issue. However, most sites host content from 4-5 different domains, which means you're going to have 4-5 different SSL handshakes, thus resulting in a mu…

If you're constantly pulling content from 4-5 different domains, perhaps you should re-think your sites architecture to minimize that. Sometimes it's unavoidable, but a lot of the time it's simply due to laziness or because the web developers are practicing the cargo-cult method of development.

Yes, this means you probably need to re-evaluate whether your "like/share/connect/plusone this" really needs to be on every page, or even any page.

You also need to re-evaluate whether you really need statistics via third parties, or if you can track them yourselves. The answer is almost always that you can do it yourself, though it might not be as convenient as, say, copy/pasting google analytics code into your template.

If you're using a content engine, take a close look at it. Turn off and remove features you don't use, don't merely hide them. You might also be surprised which plugins may be phoning home in some form, or pulling content from places you didn't expect.

Re: Protocol-Relative URLs to Fix Mixed-Content Warnings

#19

Post by spullara »

throwaway64 wrote: post #17
Jare wrote: post #7

I thought the Chrome browser had recently started to block insecure content loaded from https pages; it does for me and I don't remember changing some related settings recently. Anyway yeah, it's very sane advice.

it did, temporarily in the beta, however so much of google's own stuff had this issue (especially adwords), they scrapped the idea.

I'm now intrigued why this was voted down. I certainly saw Chrome not loading mixed content in the past. Did they really revert this behavior?

Re: Protocol-Relative URLs to Fix Mixed-Content Warnings

#20

Post by paulsutter »

We tried this at Quantcast in our tag. It worked great, but we had constant complaints from people who expected to see an "http:" in there.

Finally, we went back to two separate tags (one for http, one for https).

I hope this becomes more widely understood, it make a lot of sense.

Post reply on HN