9

I want to serve static content from my site but my site is https-only. My static http server only serve http content (non https) but many IE users are complaining about being unable to log into.

What do I need to do? Should I add https to my static-content http server?

Improve this question

2 Answers 2

Reset to default
13

Internet Explorer and I think some other browsers will warn a user when the assets for a site using the https protocol are served from http. The first best solution is to allow your static asset server to serve secure content and have your site use a consistent protocol. The second best solution is going to be to create a page on your secure site that is a proxy, basically you need to create a dynamic page that calls the external page or asset, and returns it through that proxy. How that page is written depends on what dynamic programming language is available to you on the secure server.

Basically IE has a legitimate security issue with mixing protocols. It knows it can trust the https server, but does not trust the http one.

Improve this answer
3
  • 1
    Other browsers degrade in less noisy fashions for mixed content, often modifying the behavior of the 'padlock' icon that only half of the Internet population pays attention to. I agree that IE is doing 'the right thing (TM)' by throwing an obvious warning. It is correct, some elements were sent securely, some were not.
    – Tim Post
    Commented Jul 26, 2010 at 18:59
  • The sooner there is native support to block cookies to HTTP when using HTTPS the sooner this message can disappear and stop causing problems. Its not like the additional HTTP headers are even wanted for the static content that is served away from the HTTPS page.
    – Metalshark
    Commented Jul 26, 2010 at 19:50
  • 2
    @Metalshark: it's far more than about cookies. When you look at an HTTPS page, you want to be able to trust everything it says. Someone could forge an image and replace what it shows/says, for example. You also want to link to trusted, non-altered scripts.
    – Bruno
    Commented Apr 14, 2012 at 14:36
0

I think you need to clarify your thinking because your question doesn't really make sense.

Static and secure are not mutually exclusive or even related to each other. You can have secure static content and non-secure non-static content. Secure just means it's encrypted (SSL, i.e., https). Static means it's not generated per-request for the client. These are two fundamentally different concepts.

If you're not mixing up your terminology, then I would ask why your secure server can't serve static content. My guess is that it does, so you just need to put your static content onto the secure server and then a browser won't complain about the mixed http/https content because it will all be https. If there is truly some technical limitation on the secure server that prevents it from serving static content (e.g., it can't even serve a CSS file), then yes, you should look at adding SSL to the other server you're using.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.