12

I have a site with HTTPS configured.

My client wants me to embed a youku video. At first the browser blocked the iframe since it had HTTP protocol on it.

I changed it to HTTPS and now youku does not work. It seems youku does not support HTTPS.

is there any way around this?

Perhaps there is a service other than youku that does support HTTPS and is still suitable for that region?

guy mograbi
  • 27,391
  • 16
  • 83
  • 122
  • running into the same issue. I have an https site and need youku videos, which seem to only work through http. Is there any way around that? – wiherek Jan 28 '15 at 15:24
  • I really need that though :) was looking through http://stackoverflow.com/questions/18327314/how-to-allow-http-content-within-an-iframe-on-a-https-site but can't really find a working solution. – wiherek Jan 28 '15 at 16:09
  • I've already talked with developers from youku, and they said they will support https before the end of this year (2016). – hax Dec 21 '16 at 08:09
  • @hax wow!! thanks! this is awesome. they should hurry though, 10 days to EOY. – guy mograbi Dec 21 '16 at 11:04

2 Answers2

5

hi，we had supported（sorry for later）

for example:

1

<iframe height=498 width=510 src='https://player.youku.com/embed/XMTg3Nzg4MzY4NA==' frameborder=0 'allowfullscreen'></iframe>

2

https://player.youku.com/player.php/sid/XMTg3Nzg4MzY4NA==/v.swf

3: 

<embed src='https://player.youku.com/player.php/sid/XMTg3Nzg4MzY4NA==/v.swf allowFullScreen='true' quality='high' width='480' height='400' align='middle' allowScriptAccess='always' type='application/x-shockwave-flash'></embed>
noufalcep
  • 3,446
  • 15
  • 33
  • 51
Charles Liu
  • 66
  • 1
  • 2
  • While I was not able to fully test it because it takes a long time to load I was able to verify #2 (the url) - it works over https. Please add a plunker that works for you. – guy mograbi Dec 28 '16 at 14:45
  • https://player.youku.com/embed/XMTg3Nzg4MzY4NA== [link](https://player.youku.com/embed/XMTg3Nzg4MzY4NA==) you can't load this url ? or it's too slowly ? tell result by `ping player.youku.com` – Charles Liu Dec 29 '16 at 05:20
  • Ping takes 400ms. The plunker loaded. thanks! maybe the other day stuff were slower. – guy mograbi Dec 29 '16 at 14:06
  • our server in china, we have great 'GFW', haha – Charles Liu Dec 29 '16 at 14:55
2

Youku player serves some resources (like preview images or alternative sources for video) under http, not https - and this might be the main culprit of "partially insecure content" issue in browsers. This problem is caused by Youku player itself, it's quite possible to change the code loaded from their servers.

However, the problem can be solved in most simple and convenient way by rewriting insecure http requests on given page with secure https requests - it possible to achieve this by including CSP meta tag in page header:

  <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

The "Content-Security-Policy" response header allows to control resources the user agent is allowed to load on given page (more information here).

What "upgrade-insecure-requests" directive does: "Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten."

The original solution was found in this post.

Theodore Ferkovich
  • 21
  • 2