Mixed content in Chrome and IE

google-chrome security iframe https mixed-content
vborutenko picture vborutenko · Nov 26, 2014 · Viewed 96.3k times · Source

In my HTTPS enabled site I have added an iframe that should show content from my other site, but it is not working under https.

<iframe  src="//myothersite.com"></iframe>

In Firefox latest version everything works good.

In Chrome, the iframe isn't loaded and in the console I see these two errors

Mixed Content: The page at 'https://mysite' was loaded over HTTPS, but requested an insecure resource 'http://myothersite.com'. 
This request has been blocked; the content must be served over HTTPS.
Failed to load resource: net::ERR_CACHE_MISS

In IE content load incorrectly and I see an alert message; if I click Allow Insecure Content, it loads correctly.

The question is: how I can do that IE and Chrome as in Firefox (load mixed content without any alerts)?

Note: I haven't changed any browser settings.

Answer

vtortola picture vtortola · Dec 12, 2014

Actually Firefox has started to do the same: How to fix a website with blocked mixed content

It makes sense. If the user access a site using HTTPS is expecting to have a secured experience, and he may not be aware of parts of the application loading under not secure connections. That is the reason why the browser blocks such inconsistency.

You will need to provide HTTPS on myothersite.com.

Related questions

XMLHttpRequest cannot load file. Cross origin requests are only supported for HTTP

I am getting the following error: XMLHttpRequest cannot load file:///C:/Users/richa.agiwal/Desktop/get/rm_Library/templates/template_viewSettings.html. Cross origin requests are only supported for HTTP. I realize that this question has been answered before, but …

Read More
Disable-web-security in Chrome 48+

I have a problem with the --disable-web-security flag. It is not working in Chrome 48 and Chrome 49 beta on Windows. I've tried killing all of the instances, reboot and run Chrome with the flag first of all, tried different machines as …

Read More
Does using 'badidea' or 'thisisunsafe' to bypass a Chrome certificate/HSTS error only apply for the current site?

Sometimes and especially very often when developing a web-application Chrome doesn't allow you to visit certain sites and throwing certificate/HSTS error. I've found that typing badidea (more recently thisisunsafe) in Chrome window will tell Chrome to skip certificate validation. …

Read More