0

There is a server. On the server is apache. Apache has certificates. On the apache is a website - client, thanks to certificates the client is accessible by https://example.com/~path. The client is only HTML with Javascript.

On the same server but different port runs node.js app. So when I go to http://example.com:port I get an answer.

I want to get data from node.js server with ajax from client. So far I get Mixed Content: The page at 'https://example.com/~path' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://server.com:port'. This request has been blocked; the content must be served over HTTPS.

Obviously I need node.js to be https. I can't use self-signed certificates because it's public app and people would still have to add certificate to their browser right?

What is the best solution to my situation? Can I somehow utilize certificates from apache. Does it help me that they both run on the same server? Or should I use something else?

The server is not mine, so there is a limit of what I can do.

|improve this question
3

The only solution is to use HTTPS for your AJAX service that is running on example.com:port.

One easy way to make that happen would be to use a reverse proxy on your main server that is already running HTTPS. You could set up a directory such as https://example.net/service to reverse proxy from http://example.com:port. Then your AJAX client would request the secure directory URL and your secure web server would be the only thing fetching the content from the other port. It would do so locally, so it would be far less insecure. For details about how to set up a reverse proxy directory under Apache, see this answer to a question on ServerFault.

|improve this answer
  • Okay, the server is not my so this would be a little bit hard for me I would have to write to admin and hope he will be okay with this. Before I will do that and before I will accept your answer... I guess there is no other option for me to do, without root privileges am I right? Somehow get certificates, allow communication with http://server.com:port or turn the https client into http? – Reenergy Jun 23 '18 at 19:36
  • It could be possible to put the security certificate on the software running on the other port if it supports it. You could also run your entire site as HTTP, but that is going to cause warnings in browsers too. – Stephen Ostermiller♦ Jun 23 '18 at 19:45
  • Same certificate which is used by apache? Could you please provide a link or something, that shows how to run the site as HTTP? I have tried some .htaccess configurations but nothing help. If you have something tested. – Reenergy Jun 23 '18 at 20:10
  • Apache usually runs on HTTP port 80 by default, even if HTTPS 443 is also enabled. You said it isn't your server, so you'll probably have to ask the admin to change the Listen directive or the virtual hosts. – Stephen Ostermiller♦ Jun 23 '18 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.