2

I have the following htaccess file:

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !ssl

....// lots of rewrite rules

RewriteCond %{SERVER_PORT} ^443$
RewriteCond $1 !^ssl
RewriteRule (.*) http://www.mydomain.com/$1 [R,L]
RewriteCond %{SERVER_PORT} ^80$
RewriteCond $1 ^ssl
RewriteRule (.*) https://www.mydomain.com/$1 [R,L]

Basically when I load a secure page I get lots of insecure images and js being loaded how can I modify my htacccess to get this content loading securely.

Note that the folder for the images and js are

/js 
/images

and secure content is served from /ssl

Thanks

1
  • 1
    A user can still MITM content that is being redirected. This is still vulnerable to attack, you should use the "security" tag to get a real answer.
    – rook
    Nov 21, 2011 at 15:54

3 Answers 3

5

Add this to your header section

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

This meta tag will automatically upgrade all http requests to https request. However your images must be available in https, otherwise, it will not be shown (ignored). This is the fastest way to fix mixed-content in secured pages.

1
  • Not 100% sure this was what worked, but it's a good suggestion. Thanks!
    – Jason
    Jan 15, 2020 at 14:40
2

when you're browsing a secure web page that contains non-secure content like this case(e.g image), browsers DO NOT send referrer header,So there is no server side solution to find out this is requested from secure web page or not?
you have to use relative path for those files to served securely!

0
1

You can prevent redirect, for the images and js folder, by putting this at the top of your htaccess:

RewriteRule ^(js|images)/ - [L]

Also make sure you only use relative or root-relative (or protocol-relative) urls for referencing images and javascript files.

6
  • -1 this does not prevent attack. The system is still vulnerable.
    – rook
    Nov 21, 2011 at 15:55
  • @Rook. Please explain. As long as relative urls are used, the images and js are requested using https if the current page is using https. Since the RewriteRules Dino created force https for urls starting with /ssl/, the images and js is also indirectly force to use https.
    – Gerben
    Nov 21, 2011 at 16:19
  • 1
    @Gerben an attacker is going to MITM the request, you're server will never have the opportunity to issue a redirect.
    – rook
    Nov 21, 2011 at 17:23
  • @Rook but that is an inherent problem with the internet, and there is no real solution to this problem beside Strict-Transport-Security header, which only works on repeated visits. So unless you want to -1 every answer on SO about https...
    – Gerben
    Nov 21, 2011 at 18:50
  • 1
    @Rook. Huh? If you use relative url on a https page the referred media is retrieved using https too. No need to specifically add https:// in front of every link. Also a MITM attack can still occur if the visitor first uses http to visit the page, and no redirect to the https version has occured yet.
    – Gerben
    Nov 21, 2011 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.