Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I want to serve static content from my site but my site is https-only. My static http server only serve http content (non https) but many IE users are complaining about being unable to log into.

What do I need to do? Should I add https to my static-content http server?

share|improve this question
add comment

2 Answers 2

up vote 13 down vote accepted

Internet Explorer and I think some other browsers will warn a user when the assets for a site using the https protocol are served from http. The first best solution is to allow your static asset server to serve secure content and have your site use a consistent protocol. The second best solution is going to be to create a page on your secure site that is a proxy, basically you need to create a dynamic page that calls the external page or asset, and returns it through that proxy. How that page is written depends on what dynamic programming language is available to you on the secure server.

Basically IE has a legitimate security issue with mixing protocols. It knows it can trust the https server, but does not trust the http one.

share|improve this answer
1  
Other browsers degrade in less noisy fashions for mixed content, often modifying the behavior of the 'padlock' icon that only half of the Internet population pays attention to. I agree that IE is doing 'the right thing (TM)' by throwing an obvious warning. It is correct, some elements were sent securely, some were not. –  Tim Post Jul 26 '10 at 18:59
    
The sooner there is native support to block cookies to HTTP when using HTTPS the sooner this message can disappear and stop causing problems. Its not like the additional HTTP headers are even wanted for the static content that is served away from the HTTPS page. –  Metalshark Jul 26 '10 at 19:50
1  
@Metalshark: it's far more than about cookies. When you look at an HTTPS page, you want to be able to trust everything it says. Someone could forge an image and replace what it shows/says, for example. You also want to link to trusted, non-altered scripts. –  Bruno Apr 14 '12 at 14:36
add comment

I think you need to clarify your thinking because your question doesn't really make sense.

Static and secure are not mutually exclusive or even related to each other. You can have secure static content and non-secure non-static content. Secure just means it's encrypted (SSL, i.e., https). Static means it's not generated per-request for the client. These are two fundamentally different concepts.

If you're not mixing up your terminology, then I would ask why your secure server can't serve static content. My guess is that it does, so you just need to put your static content onto the secure server and then a browser won't complain about the mixed http/https content because it will all be https. If there is truly some technical limitation on the secure server that prevents it from serving static content (e.g., it can't even serve a CSS file), then yes, you should look at adding SSL to the other server you're using.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.