2

In IE7 my web site always causes the browser to prompt a "Security Information" dialogue box:

This page contains both secure and non-secure items.

Do you want to display the non-secure items?

How can I avoid getting this message when traveling between non-secure and secure pages (HTTP to HTTPS)?

6 Answers 6

14

You need to make sure all your images, script files, CSS files and so on have HTTPS urls if you're on a secure page.

If you view-source and search for "http:" this will soon tell which one (or more) is wrong.

Example:

<script src="script.js" type="text/javascript"></script> - Correct
<script src="https://ssl.google.com/ga.js" type="text/javascript"></script> - Correct
<script src="http://www.google.com/ga.js" type="text/javascript"></script> - Wrong
1
3

RoBorg has it dead on. However, it can be tricky sometimes to track down the specific page or item causing the problem. Often it is a broken link that redirects to the "404-page not found" page.

A trick I like to use is to hit the page and answer in the affirmative on the prompt then look at the IIS log entries generated for any rows with an 80 in the port column instead of 443.

1

You should make sure that you haven't included http:// explicitly anywhere in your code. If you did then that message will be displayed.

0

There is also an option in IE to toggle this message when moving from HTTP to HTTPS pages. In IE7, it's on the advanced tab, second checkbox from the bottom.

There is also a 'Display mixed content' option in IE7, security tab, custom level.
Set it to Enabled for the site level you're accessing the site as.

2
  • You cant ask all the website users to do this :)
    – Shoban
    Feb 10, 2009 at 15:22
  • Of course not, but as far as i'm aware that's the only way to remove that message when browsing from a non-secure to a secure webpage. To remove it from one particular webpage, use RoBorg's answer.
    – Bravax
    Feb 10, 2009 at 15:56
0

For anyone still trying to solve odd IE7 security warnings:

I found a case where IE7 incorrectly gives the warning. It happens if using jQuery.get() to add HTML content that has an inline style with a relative url. See test case.

Possible fixes include:

  • using an absolute url
  • moving the styles to a CSS files (might need to be loaded on page load)
  • using jQuery.load() or some other technique might also help
0

We use this trick in the HTML5 Boilerplate for a clever request of jQuery off the Google CDN:

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
<script>window.jQuery || document.write('<script src="js/vendor/jquery-1.9.0.min.js"><\/script>')</script>

instead of adding any http: or https: in the src. which will work fine in every case

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.