Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

When I visit our web site pages with IE over HTTPS, it reports the web site as protected (i.e. no elements are taken using HTTP). The same page, when loaded to Firefox, causes Firefox to complain that some elements are non-secure. I checked the source code of the page and the list of resources of the page (Firefox displays the list of resources) - there are no http resources, only HTTPS ones are listed.

The question is - how do I diagnose, what resources (images or CSS or JavaScript) are loaded using HTTP and not HTTPS? I assume that some plugin is needed. Firebug doesn't have anything helpful, as it seems.

Update:

The mystery has been discovered. Under certain [rare] combination of conditions Facebook instead of providing a PNG image of the page statistics (embedded into the page) reports the error (some HTML via Javascript). As the original resource is a PNG, Firefox simply doesn't display that PNG, but seems to execute the javascript code, sent by Facebook. Obviously, this JavaScript could not be easily tracked as it was not being displayed or even mentioned anywhere (except maybe deep in the DOM inspector). Changing the conditions eliminated the erroneous javascript. However, the question regarding the tool that would help discover such "hidden" code and other resources remains actual.

share|improve this question
    
I'm glad you found the issue. :) Add your own discovery as an answer or accept somebody's else's. –  Liam William Apr 29 '11 at 23:01
    
@Lime at the moment the answer is not found. The question was about a tool to find such issues. –  Eugene Mayevski 'EldoS Corp Apr 30 '11 at 5:17
add comment

4 Answers 4

up vote 1 down vote accepted

Grab the add-on Httpfox.

After the installation, restart the browser and you'll have a new icon in your status bar. Right-click it and choose "Open in a new window". In that way, you can maximize the window and get a faster overview of all URL's. Press Start and reload your page.

Alternatively, use the Web developer toolbar to get a list of all images, CSS and Javascript files.

share|improve this answer
add comment

Just view the source code and look for anything that is loaded with http:// and not https://. Any basic text editor can do this quickly for you. Be sure to check

  • JavaScripts
  • Stylesheets
  • Images
  • Objects
  • Frames

update

  • Scripts and widgets from other sites like Facebook
  • Favicon

Make sure you manually check as Firefox may not be reporting all resources on the page. Just media.

share|improve this answer
    
Please re-read the question. I explicitly mentioned, that I have checked the source code. If it was that simple, I wouldn't waste anyone's time by posting the question. –  Eugene Mayevski 'EldoS Corp Apr 29 '11 at 13:26
add comment

You could try http://www.webpagetest.org/

Run your https URL through the site, then click on the 'waterfall view'. All resources loaded over https will display a padlock icon. Those loaded over http won't. Here's what the output for https://twitter.com looks like, for example:

Testing for https resources with webpagetest.org

share|improve this answer
    
Thank you for a tip. This site appears to be generally very useful tool and it would solve the problem (with one minor exception - in my rare combination of factors firefox and my cookies played the key role). So I am still looking for firefox add-in if one exists. –  Eugene Mayevski 'EldoS Corp Apr 29 '11 at 17:52
1  
I don't know of a Firefox plugin, but 'Charles' is a nifty app for Windows, Mac, and Linux that lets you monitor traffic between your browser and the Web: charlesproxy.com It sounds like it would be handy for HTTPS debugging. There is also Fiddler (Windows only): fiddler2.com/fiddler2 –  Nick May 7 '11 at 17:23
add comment

Something like Fiddler should be able to catch all http related traffic between your browser and any web servers required to load a page.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.