Let the browser no longer display HTTP request alerts in HTTPS pages

HTTPS is an HTTP over secure Socket Layer with a security-targeted HTTP channel, so HTTP requests are not allowed on HTTPS-hosted pages, as soon as a prompt or an error occurs:

Mixed content:the page at ' https://www.taobao.com/' is loaded over HTTPS, but requested an insecure image ' http://g.alic Dn.com/s.gif '. This content should also is served over HTTPS.

After the HTTPS transformation, we can see the following alerts on many pages:

Many operations on the HTTPS no technical concept, in the data filled with the inevitable HTTP resources, the system is large, negligence and loopholes are unavoidable.

CSP Setup Upgrade-insecure-requests

Fortunately, the Working Group took into account our difficulties in upgrading HTTPS, in April 2015, a Upgrade Insecure Requests draft, his role is to allow the browser to automatically upgrade the request.

In the response header of our server, add:

Header ("content-security-policy:upgrade-insecure-requests");

Our page is HTTPS, and this page contains a large number of HTTP resources (Pictures, IFRAME, etc.), the page once found that the above response header, will be loaded HTTP resources automatically replaced with HTTPS requests. You can view a demo provided by Google:

However, it is puzzling that this resource issued two requests, guessing is the browser implementation of the bug:

Of course, if we are not convenient to operate on the server/nginx, we can also add headers to the page meta :

<http-equiv= "Content-security-policy"  Content= " Upgrade-insecure-requests "/>

Only Chrome 43.0 is currently supported for this setting, but I am confident that CSP will be a major concern and use for future Web front-end security. And the upgrade-insecure-requests draft will soon go into RFC mode.

From the example of the Working Group, it can be seen that this setting does not deal with a link to the external domain, so you can use it with confidence.

Related reading

• http://www.w3.org/TR/mixed-content/
• https://www.chromestatus.com/feature/6534575509471232

Let the browser no longer display HTTP request alerts in HTTPS pages