Finding All Insecure Content on a Secure Page

browser security browser-security
Cerin picture Cerin · Jan 18, 2011 · Viewed 77.6k times · Source

What's the most efficient way to find a list of all non-HTTPS URLs requested by an HTTPS page? If this kind of security violation happens, every browser alerts the user, but I can't find an easy way to find what exact URLs cause the violation.

The easiest way I've found so far is to use Firefox, but even then it's still not very convenient. First, I can right-click, select View Page Info, click the Media tab, and scroll through a list of URLs. However, this seems to only list image files, not CSS or JS includes that can also cause the error. For those, I have to use the Firebug extension, select the Net tab, and manually hover my mouse over each item to see the entire URL. Unfortunately, this can take a while if you have dozens of media files. Is there a better way?

Answer

Cerin picture Cerin · Nov 18, 2011

Note, in recent versions of Chrome, these errors will be displayed in the Javascript Console.

e.g.

The page at https://mysecuresite.com displayed insecure content from http://unsecuresite.com/some.jpg.

Related questions

How to remove 'Authorization: Basic username:password' header from browser

I've been trying to make use of the native login prompt that is available in browsers: and have been following Steven Sanderson's blog post. As mentioned in the blog, once a user enters their login details once the browser then …

Read More
Disable browser 'Save Password' functionality

One of the joys of working for a government healthcare agency is having to deal with all of the paranoia around dealing with PHI (Protected Health Information). Don't get me wrong, I'm all for doing everything possible to protect people's …

Read More
Is JSON Hijacking still an issue in modern browsers?

I am using Backbone.js and the Tornado web server. The standard behavior for receiving collection data in Backbone is to send as a JSON Array. On the other hand, Tornado's standard behavior is to not allow JSON Array's due …

Read More