How to get Latest Chrome (Version 55) to allow mixed content?

javascript ajax google-chrome google-chrome-extension mixed-content
David Cruwys picture David Cruwys · Jan 6, 2017 · Viewed 10.8k times · Source

I have a chrome extension that communicates using HTTP in development and HTTPS in production.

I run it from webpages that use HTTPS.

When I use this extension in my development mode I get the following error.

Mixed Content: The page at 'https://somesite.com' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://david-sniper.local:3001/api/end-point'. This content should also be served over HTTPS.

In the past I have been able to resolve this error by going reading this post how-to-get-chrome-to-allow-mixed-content

There are two solutiions in this post.

  1. "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --allow-running-insecure-content
  2. In the address bar at the right end should be a 'shield' icon, you can click on that to run insecure content.

I have never had success with the first solution, but the second solution where you click on the 'shield' icon was working up until a few weeks ago.

I'm now on Chrome 55 and there is NO Shield option to click on, so I'm wondering how to get mixed content working in developer mode?

enter image description here

Answer

David Cruwys picture David Cruwys · Jan 8, 2017

Following a tip by Zig Mandel, I used command line parameters to run Chrome without security.

I created a folder called c:\_chrome_data and I unpacked my developer extension into chrome extensions and I used this command line.

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --allow-running-insecure-content --disable-web-security --user-data-dir=C:\_chrome_data

Click the Shield, I noticed that the shield is not available in Version 55 of chrome anymore unless you have the settings listed in the command line included.

enter image description here

Working Extension

enter image description here

Related questions

Disable same origin policy in Chrome

Is there any way to disable the Same-origin policy on Google's Chrome browser?

Read More
Updating address bar with new URL without hash or reloading the page

I either dreamt about chrome (dev channel) implementing a way to update the address bar via javascript (the path, not domain) without reloading the page or they really have done this. However, I can't find the article I think I …

Read More
Origin <origin> is not allowed by Access-Control-Allow-Origin

XMLHttpRequest cannot load http://localhost:8080/api/test. Origin http://localhost:3000 is not allowed by Access-Control-Allow-Origin. I read about cross domain ajax requests, and understand the underlying security issue. In my case, 2 servers are running locally, and like to enable cross …

Read More