HTTPS on all pages where user is logged on

Question

I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted with URL's over HTTPS or the url itself doesn't support HTTPS. This throws up a lot of ugly browser warnings.

I see I have two options:

• Disable HTTPS for the forum
• Force all user posted content to start with // in the url so it selects the right protocol, if it doesn't support HTTPS so be it

Do I have any other options? How do other sites deal with this?

Answer 1

Option 3 is to proxy the images. However, this has legal issues.

Option 4 is to replace http://... images with a placeholder to open them in a new tab. Optionally have the server code first rewrite to https:// and make a request to check whether it's supported.