Groups | Blog | Home
all groups > iis security > june 2007 >

iis security : HTTPS - Mixed content warning


thepisu NO[at]SPAM gmail.com
6/26/2007 12:24:02 AM
Hi, I've set up a website to use HTTPS SSL connection. It works right,
except that at loading of the main frameset, IE show up a warning:
"the page contains protected and non protected objects"; so the user
have to click "Yes", and the SSL symbol disappears from the browser...

I've searched over frameset and frame HTML, but there is no reference
to HTTP content.. How can I find the item presenting the problem???

Many thanks...
Roger Abell [MVP]
6/27/2007 11:51:10 PM
Pull the page up in IE and then look at the IE cache (IE, Internet Options,
General tab, Browsing History - Settings, Show Files and Show Objects)
and sort by last accessed.


[quoted text, click to view]

Bernard Cheah [MVP]
6/28/2007 12:00:00 AM
Argghh, search all src reference of images, etc.
another way I can think off is via the IIS log file.
look for non port 443 request, or port 80 request within those 443 log
entries.

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

thepisu NO[at]SPAM gmail.com
6/28/2007 10:07:22 AM
Damn! In browser cache all files are addressed with "HTTPS", and in
IIS Log, all files (pages, images, JS, CSS..) are all server by port
8091, that is the port I set to be HTTPS...

The warning appears only in Internet Explorer, tried IE6 and 7 (does
not appear in Firefox), when the main page are loaded (that contains
an iframe javascript-driven, that appears to be also server with
HTTPS).

I'm going crazy... :(

[quoted text, click to view]
thepisu NO[at]SPAM gmail.com
6/28/2007 10:25:04 AM
Problem resolved! I am using the javascript library YUI-EXT (now
Ext.js), and I have to set the variabile YAHOO.ext.SSL_SECURE_URL to
point a blank file:

YAHOO.ext.SSL_SECURE_URL='/js/images/blankfile';

http://www.yui-ext.com/manual/faq

IE is so strange... how can he found "javascript:false" a non-secure
url???

[quoted text, click to view]

Bernard Cheah [MVP]
7/2/2007 12:00:00 AM
@@ glad you figured out.

--
Regards,
Bernard Cheah
http://www.iis.net/
http://www.iis-resources.com/
http://msmvps.com/blogs/bernard/


[quoted text, click to view]

AddThis Social Bookmark Button