Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted with URL's over HTTPS or the url itself doesn't support HTTPS. This throws up a lot of ugly browser warnings.

I see I have two options:

  • Disable HTTPS for the forum
  • Force all user posted content to start with // in the url so it selects the right protocol, if it doesn't support HTTPS so be it

Do I have any other options? How do other sites deal with this?

share|improve this question

Option 3 is to proxy the images. However, this has legal issues.

Option 4 is to replace http://... images with a placeholder to open them in a new tab. Optionally have the server code first rewrite to https:// and make a request to check whether it's supported.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.