Insecure content on HTTPS page

3
votes

I have a dev site set up that's running under a fake HTTPS, it has a certificate however Chrome says its invalid because of the domain. My real site has a real certificate however, and I'm wondering if that HTTPS connection will break because of some insecure content on my page.

I'm using Brightcove as a 3rd party video host and when using their embed code, I get these types of errors in the Chrome developer console on my dev site:

The page at https://my.website.com/ displayed insecure content from http://c.brightcove.com/crossdomain.xml.

If I deploy the development version to my live site, will it break the HTTPS seal in the address bar of browsers? HTTPS is very important for my customers so I'd rather not deploy it and just see what happens.

Unfortunately Brightcove doesn't have "true" HTTPS support, it's either get these errors or the video doesn't work. :/

Also, the video is being loaded via JavaScript if that matters.

Thanks!

1
javascripthtmlhttpsnginx
Use relative URLs, and use protocol-less external URLs. For example, using //code.example.com/js/jquery.js will automatically use https if your page already is, or http if your page is - Ian
@Ian: that external site doesn't support requests over HTTPS, that's the issue as it seems. Other than that, your suggestion is valid. It's how it should be done. - Ma3x
@Ma3x Ahh yes, I see. I should've tested that first (and read everything properly first) - Ian

1 Answers

6
votes

If you include content from insecure sources (http), the seal will break. it's still safe but it won't be shown as prominent as on a page with only secure content inclusion.