9

I have a forum where, like most forums, users can post images. I've set up HTTPS across the site, but of course most external images are linked using HTTP, not HTTPS. So loading the forum over HTTPS shows mixed content warnings, etc.

What are some strategies for tackling this problem? Some of the images are from my own site so I can rewrite those URLs to use HTTPS since I know it will work. But for external URLs many don't work with HTTPS so I can't do a blanket rewrite.

I could rewrite non-secure images to links instead of inline images, but that doesn't look great and may be confusing for users. Any better solutions?

Improve this question
5
  • 2
    You could use camo…
    – wb9688
    Commented Sep 18, 2016 at 5:27
  • 2
    Google hasn't solved this for image search. Image search is "not secure:" i.imgur.com/8XVTQsi.png
    – Stephen Ostermiller ♦
    Commented Sep 18, 2016 at 11:55
  • 2
    See also on StackOverflow: Dealing with HTTP content in HTTPS pages
    – Stephen Ostermiller ♦
    Commented Sep 18, 2016 at 12:02
  • 1
    Better I don't know, and it may run afoul of copyright legislation, but one technical solution would be to make a copy of the image and serve from a domain under your control, over HTTPS...
    – user
    Commented Sep 18, 2016 at 13:17
  • 1
    The poor mans way: Upon save/edit you can apply logic to rewrite all the data that is intended to be src="http://someimage.jpg" to the relative structured src="//someimage.jpg" instead...or just validate it. If you want a strict green lock (where an insecure image wont wonk your lock) enforce HSTS. Then in the editor interface make a note that images currently must be available via HTTPS, else they will not show up at all. Something like "Oops, you made an error. To prevent abuse and MITM attacks, all media must use HTTPS. Go back and correct it, or choose another image provider.".
    – dhaupin
    Commented Sep 19, 2016 at 20:12

2 Answers 2

Reset to default
1

It's not possible to have insecure resources in a secure page, and not get the mixed content warning.

For user agents that support it, the upgrade-insecure-requests directive is an instruction to attempt to load the resource over https or fail trying.

Other user agents will ignore the directive, continuing to load the insecure resources.

Here is an article on the Google Developers site discussing this and other options.

Improve this answer
1

Just realised that I never posted my solution. The answer provided in Stephen's comment is what solved it for me. In short, I created a proxy script that does the following:

  1. If the image is https, leave it alone.
  2. If the image is http and from a site known to support https (e.g. my own site, imgur.com etc) then rewrite to https.
  3. Otherwise if the image is http, rewrite it to use http://example.com/imgproxy?img=ORIGINALURL&hash=KEY

Then the proxy script fetches the HTTP image, caches it locally, and outputs the image data. On repeated requests it outputs the cached data directly. The linked SO answer describes the security hash and other details.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.