javascript - Mixed Content warning on Chrome due to iframe src -
somewhere in code, on secure site, following snippet used:
var iframe = document.createelement("iframe"); iframe.setattribute("src", "pugpig://onpageready"); document.documentelement.appendchild(iframe); iframe.parentnode.removechild(iframe); iframe = null; the iframe src attribute set here triggering callback it's causing chrome (version 54) complain "mixed content" src attribute interpreted non-https url on https:// domain , version of chrome not presenting users easy option allow mixed content load anyway (e.g. shield icon in address bar).
changing chrome version / using different browser / starting chrome --allow-running-insecure-content switch not option reasons question is, there way make "pugpig://onpageready" part perceived https url?
you can try this:-
<meta http-equiv="content-security-policy" content="upgrade-insecure-requests" /> or
<meta http-equiv="content-security-policy" content="block-all-mixed-content" /> paste in <head>...</head> tags.
the http content-security-policy (csp) block-all-mixed-content directive prevents loading assets using http when page loaded using https.
all mixed content resource requests blocked, including both active , passive mixed content. applies <iframe> documents, ensuring entire page mixed content free.
the upgrade-insecure-requests directive evaluated before block-all-mixed-content , if former set, latter no-op. recommended set 1 directive or other – not both.
Comments
Post a Comment