I know this is considered best practise to prevent cookie hijacking. I would like to adopt this approach, but ran across a problem on our forum where the users post images which either aren't posted with URL's over HTTPS or the url itself doesn't support HTTPS. This throws up a lot of ugly browser warnings.
I see I have two options:
- Disable HTTPS for the forum
- Force all user posted content to start with
//in the url so it selects the right protocol, if it doesn't support HTTPS so be it
Do I have any other options? How do other sites deal with this?