Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted with URL's over HTTPS or the url itself doesn't support HTTPS. This throws up a lot of ugly browser warnings.

I see I have two options:

  • Disable HTTPS for the forum
  • Force all user posted content to start with // in the url so it selects the right protocol, if it doesn't support HTTPS so be it

Do I have any other options? How do other sites deal with this?

share|improve this question
add comment

1 Answer 1

Option 3 is to proxy the images. However, this has legal issues.

Option 4 is to replace http://... images with a placeholder to open them in a new tab. Optionally have the server code first rewrite to https:// and make a request to check whether it's supported.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.