1

In chrome My SSL related page got blank on other browser it works fine. It gives the error message

"The page at https://xyz.com/test/checkout ran insecure content from http://xyz.com/test/checkout/css/styles.css"

In my website some pages are on SSL,I have only one masterpage which is used in both type of pages(http and https),I want to use my css and js which will work on both conditions.

Askiitians
  • 291
  • 7
  • 18

4 Answers4

2

Check any resources in the CSS file (like images and background images).

If they link to the HTTP domain see if you can rewrite them to be a relative path, so the HTTP/HTTPS switching is automatic.

Halcyon
  • 57,230
  • 10
  • 89
  • 128
1

It is safe (and permitted) to include CSS that is served over HTTPS in a web-page that is served over regular HTTP; so, one option is to use https://xyz.com/test/checkout/css/styles.css in all cases.

Another option, since the path seems to be the same for both versions, is to use //xyz.com/test/checkout/css/styles.css (not specifying the protocol); then the same protocol will be used for the CSS as is used for the HTML.

ruakh
  • 175,680
  • 26
  • 273
  • 307
  • It may be safe to do, but it requires more server resources to do so. Only serve over https if you actually need to. – cimmanon Oct 29 '12 at 17:44
  • @cimmanon: That's a matter of opinion; see e.g. http://stackoverflow.com/questions/548029/how-much-overhead-does-ssl-impose. Google found that using only HTTPS for Gmail increased their CPU overhead by only about 1%. I've also read other reports saying that that's an unusual case, that other people would have a much bigger proportional increase, and so on; but "Only serve over https if you actually need to" is definitely not uncontroversial advice. – ruakh Oct 29 '12 at 17:49
1

There are probably links in your CSS file that relate to a non-secure location.

I would suggest checking that file so you can make any updates.

Alternatively, on your server you could do a URL rewrite so anything that comes through on HTTP is re-written to HTTPS.

ajtrichards
  • 29,723
  • 13
  • 94
  • 101
0

Using a protocol-independent absolute path is what you can leverage:

http://blog.httpwatch.com/2010/02/10/using-protocol-relative-urls-to-switch-between-http-and-https/

defau1t
  • 10,593
  • 2
  • 35
  • 47