http content got served on https website issue
0
I converetd http web to https ( https using nodejs ).
There is a dropdown on website which on select downloads excel files ( from another http ( not https) server.
Now this still downloads excel files despite being https now.
I'm not using any mixed content plugin or any such or cors.
Please clear my doubts. How http content got served on https ?
node.js http https web-development-server mixed-content
asked Nov 24 '18 at 10:42
nitsnits
345
add a comment |
0
I converetd http web to https ( https using nodejs ).
There is a dropdown on website which on select downloads excel files ( from another http ( not https) server.
Now this still downloads excel files despite being https now.
I'm not using any mixed content plugin or any such or cors.
Please clear my doubts. How http content got served on https ?
node.js http https web-development-server mixed-content
asked Nov 24 '18 at 10:42
nitsnits
345
A download is a navigation to a different URL. It’s not an embedded resource, like an image or video or stylesheet or script. Mixed-content restrictions only affect resources that are embedded in document; they don’t affect resources that the document provides a link for downloading — any more than they prevent the document from having anahyperlink with anhrefto some non-https site. Once a user follows such a link, they’ve navigated away from the original document to a completely different document. Similarly, downloads are completely different documents.
– sideshowbarker
Nov 24 '18 at 21:34
@sideshowbarker its not a direct download link in my case( i forgot to mention ). On click a restAPI call is made to another subdomain( http) which serves the http content. Since click is actived on client side , shouldn't browser prevent call to http link ?
– nits
Nov 27 '18 at 5:59
Regardless of how the download is initiated, the downloaded item isn’t part of the content of the document. So the document doesn’t have any mixed content. The scope of the mixed-content spec is the document, including any resources that get embedded the document — because those are the resources that if served insecurely can compromise the integrity of the document. And the purpose of the mixed-content spec is to prevent the integrity of a document from being compromised. A download from an insecure URL doesn’t affect the integrity of the document from which the download is initiated.
– sideshowbarker
Nov 27 '18 at 6:17
add a comment |
0
0
0
I converetd http web to https ( https using nodejs ).
There is a dropdown on website which on select downloads excel files ( from another http ( not https) server.
Now this still downloads excel files despite being https now.
I'm not using any mixed content plugin or any such or cors.
Please clear my doubts. How http content got served on https ?
node.js http https web-development-server mixed-content
asked Nov 24 '18 at 10:42
nitsnits
345
I converetd http web to https ( https using nodejs ).
There is a dropdown on website which on select downloads excel files ( from another http ( not https) server.
Now this still downloads excel files despite being https now.
I'm not using any mixed content plugin or any such or cors.
Please clear my doubts. How http content got served on https ?
node.js http https web-development-server mixed-content
node.js http https web-development-server mixed-content
asked Nov 24 '18 at 10:42
nitsnits
345
asked Nov 24 '18 at 10:42
nitsnits
345
asked Nov 24 '18 at 10:42
nitsnits
345
asked Nov 24 '18 at 10:42
nitsnits
345
asked Nov 24 '18 at 10:42
nitsnits
345
345
A download is a navigation to a different URL. It’s not an embedded resource, like an image or video or stylesheet or script. Mixed-content restrictions only affect resources that are embedded in document; they don’t affect resources that the document provides a link for downloading — any more than they prevent the document from having anahyperlink with anhrefto some non-https site. Once a user follows such a link, they’ve navigated away from the original document to a completely different document. Similarly, downloads are completely different documents.
– sideshowbarker
Nov 24 '18 at 21:34
@sideshowbarker its not a direct download link in my case( i forgot to mention ). On click a restAPI call is made to another subdomain( http) which serves the http content. Since click is actived on client side , shouldn't browser prevent call to http link ?
– nits
Nov 27 '18 at 5:59
Regardless of how the download is initiated, the downloaded item isn’t part of the content of the document. So the document doesn’t have any mixed content. The scope of the mixed-content spec is the document, including any resources that get embedded the document — because those are the resources that if served insecurely can compromise the integrity of the document. And the purpose of the mixed-content spec is to prevent the integrity of a document from being compromised. A download from an insecure URL doesn’t affect the integrity of the document from which the download is initiated.
– sideshowbarker
Nov 27 '18 at 6:17
add a comment |
A download is a navigation to a different URL. It’s not an embedded resource, like an image or video or stylesheet or script. Mixed-content restrictions only affect resources that are embedded in document; they don’t affect resources that the document provides a link for downloading — any more than they prevent the document from having anahyperlink with anhrefto some non-https site. Once a user follows such a link, they’ve navigated away from the original document to a completely different document. Similarly, downloads are completely different documents.
– sideshowbarker
Nov 24 '18 at 21:34
@sideshowbarker its not a direct download link in my case( i forgot to mention ). On click a restAPI call is made to another subdomain( http) which serves the http content. Since click is actived on client side , shouldn't browser prevent call to http link ?
– nits
Nov 27 '18 at 5:59
Regardless of how the download is initiated, the downloaded item isn’t part of the content of the document. So the document doesn’t have any mixed content. The scope of the mixed-content spec is the document, including any resources that get embedded the document — because those are the resources that if served insecurely can compromise the integrity of the document. And the purpose of the mixed-content spec is to prevent the integrity of a document from being compromised. A download from an insecure URL doesn’t affect the integrity of the document from which the download is initiated.
– sideshowbarker
Nov 27 '18 at 6:17
A download is a navigation to a different URL. It’s not an embedded resource, like an image or video or stylesheet or script. Mixed-content restrictions only affect resources that are embedded in document; they don’t affect resources that the document provides a link for downloading — any more than they prevent the document from having an
a hyperlink with an href to some non-https site. Once a user follows such a link, they’ve navigated away from the original document to a completely different document. Similarly, downloads are completely different documents.– sideshowbarker
Nov 24 '18 at 21:34
A download is a navigation to a different URL. It’s not an embedded resource, like an image or video or stylesheet or script. Mixed-content restrictions only affect resources that are embedded in document; they don’t affect resources that the document provides a link for downloading — any more than they prevent the document from having an
a hyperlink with an href to some non-https site. Once a user follows such a link, they’ve navigated away from the original document to a completely different document. Similarly, downloads are completely different documents.– sideshowbarker
Nov 24 '18 at 21:34
@sideshowbarker its not a direct download link in my case( i forgot to mention ). On click a restAPI call is made to another subdomain( http) which serves the http content. Since click is actived on client side , shouldn't browser prevent call to http link ?
– nits
Nov 27 '18 at 5:59
@sideshowbarker its not a direct download link in my case( i forgot to mention ). On click a restAPI call is made to another subdomain( http) which serves the http content. Since click is actived on client side , shouldn't browser prevent call to http link ?
– nits
Nov 27 '18 at 5:59
Regardless of how the download is initiated, the downloaded item isn’t part of the content of the document. So the document doesn’t have any mixed content. The scope of the mixed-content spec is the document, including any resources that get embedded the document — because those are the resources that if served insecurely can compromise the integrity of the document. And the purpose of the mixed-content spec is to prevent the integrity of a document from being compromised. A download from an insecure URL doesn’t affect the integrity of the document from which the download is initiated.
– sideshowbarker
Nov 27 '18 at 6:17
Regardless of how the download is initiated, the downloaded item isn’t part of the content of the document. So the document doesn’t have any mixed content. The scope of the mixed-content spec is the document, including any resources that get embedded the document — because those are the resources that if served insecurely can compromise the integrity of the document. And the purpose of the mixed-content spec is to prevent the integrity of a document from being compromised. A download from an insecure URL doesn’t affect the integrity of the document from which the download is initiated.
– sideshowbarker
Nov 27 '18 at 6:17
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53457320%2fhttp-content-got-served-on-https-website-issue%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53457320%2fhttp-content-got-served-on-https-website-issue%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
A download is a navigation to a different URL. It’s not an embedded resource, like an image or video or stylesheet or script. Mixed-content restrictions only affect resources that are embedded in document; they don’t affect resources that the document provides a link for downloading — any more than they prevent the document from having an
ahyperlink with anhrefto some non-https site. Once a user follows such a link, they’ve navigated away from the original document to a completely different document. Similarly, downloads are completely different documents.– sideshowbarker
Nov 24 '18 at 21:34
@sideshowbarker its not a direct download link in my case( i forgot to mention ). On click a restAPI call is made to another subdomain( http) which serves the http content. Since click is actived on client side , shouldn't browser prevent call to http link ?
– nits
Nov 27 '18 at 5:59
Regardless of how the download is initiated, the downloaded item isn’t part of the content of the document. So the document doesn’t have any mixed content. The scope of the mixed-content spec is the document, including any resources that get embedded the document — because those are the resources that if served insecurely can compromise the integrity of the document. And the purpose of the mixed-content spec is to prevent the integrity of a document from being compromised. A download from an insecure URL doesn’t affect the integrity of the document from which the download is initiated.
– sideshowbarker
Nov 27 '18 at 6:17