19

I have been trying to migrate my site from divshot to firebase, since firebase has taken over divshot and shut it down.

Mine is a simple read only site that does not need https. It also contains links to external sites which do not support https. The site worked perfectly on divshot but it looks like firebase forces all sites to use https. Unfortunately, this causes the external sites that my site references to fail loading. The error being:

Mixed Content: The page at 'https://mysite.firebaseapp.com/' was loaded over HTTPS, but requested an insecure resource 'http://www.externalsite.com/'. This request has been blocked; the content must be served over HTTPS.

I tried to remove the http: so the external site is just //www.externalsite.com/, but this causes certificate errors. I can't change it to https since this external site doesn't support it.

Is there any way around this problem?

Alex Mamo
  • 130,605
  • 17
  • 163
  • 193
Bob Hogan
  • 191
  • 1
  • 1
  • 5

1 Answers1

21

The short answer is no. This is completely by design. It's a security flaw to allow http on a https site. Therefore it's blocked.

However,

  • Solution 1: Find a https version of resource This might not be possible in your case.
  • Solution 2: convert resource to https It might be possible to host the file or resource yourself with https. This may require you to copy a file or something, which I say carefully, don't pirate stuff that you shouldn't.
  • Solution 3: Redirect This one is probably the most involved solution to do but if you are trying to access some service then you could make your own service to redirect it. You are on firebase which means you could probably hack together some cloud function to make a http request (How to make an HTTP request in Cloud Functions for Firebase?)
  • Solution 4: Don't use Firebase Don't want to do any of the above and you can't live with out the http call? You might just dump firebase and move to some other hosting service.

Hope you find this helpful it might not be the answer your looking for but it might point you in the right direction.

Niles Tanner
  • 3,911
  • 2
  • 17
  • 29
  • Thanks for answering Niles :) Just to confirm is it possible to switch to `http` in firebase? – shramee Sep 15 '17 at 12:10
  • @shramee No. You would not be able to use firebase to host a site with http. Firebase is owned by Google and Google is pushing https hard so it's very unlikely this will ever change. The solutions I presented are ways you might be able to get around issues with http sources. – Niles Tanner Sep 15 '17 at 13:32
  • This makes Firebase a terrible option for IOT, eventhough https is perfect for web - it sadly does not work for small machines who lacks the needed processing power to handle https handshakes and the encryption portion. The Firebase DBs are actually perfect for this, but by design Google excludes this market. No use building millions of new devices with extra processing, just because the network requires more security. Fridges and Google don't mix, hackers and users don't care if it's useless one way trafic. Honestly a fridge hardly requires to be locked down like Fort Knox. – Daniel ZA Jun 26 '22 at 20:10