ansaurus

Question

Answer 1

+1 A:

You could attempt to load the the https page in an iframe and route all ajax requests in/out of the frame via some bridge, it's a hackaround but it might work (not sure if it will impose the same access restrictions given the secure context). Otherwise a local http proxy to reroute requests (like any cross domain calls) would be the accepted solution.

Quintin Robinson 2009-07-09 19:22:09

Answer 2

+2 A:

Proxy all your requests through a non-https resource on your domain, would be the way to go, as you suggested. Along the lines of:

<html>
<head>
<script src="/js/jquery-1.3.2.js"></script>
</head>
<body>
<script>
$.get("www.mydomain.com/?get=someresource", function(response) { 
    alert(response) 
});
</script>
</body>

karim79 2009-07-09 19:22:10

Wouldn't that remove the benefits of HTTPS?

ceejayoz 2009-07-09 19:23:10

Yes, I think it would. If the secured data *needs* to be fetched through ajax and there's no other way to do it, then this will work.

karim79 2009-07-09 19:26:35

thanx mate. i decided to proxy http calls to https calls :) as you suggested.

2009-07-09 19:44:47

Answer 3

+1 A:

http://example.com/ may resolve to a different VirtualHost than https://example.com/ (which, as the Host header is not sent, responds to the default for that IP), so the two are treated as separate domains and thus subject to crossdomain JS restrictions.

JSON callbacks may let you avoid this.

ceejayoz 2009-07-09 19:24:51

Answer 4

+2 A:

Try JSONP.

most JS libraries make it just as easy as other AJAX calls, but internally use an iframe to do the query.

if you're not using JSON for your payload, then you'll have to roll your own mechanism around the iframe.

personally, i'd just redirect form the http:// page to the https:// one

Javier 2009-07-09 19:58:00

hmm i have tried jquery .ajax with jsonp:'jsonp_callback' option set, but still same js error.

2009-07-09 20:18:39

maybe you have to add the callback parameter in the URL

Javier 2009-07-10 03:47:31

Answer 5

A:

Check out the opensource Forge project. It provides a JavaScript TLS implementation, along with some Flash to handle the actual cross-domain requests:

http://github.com/digitalbazaar/forge/blob/master/README

In short, Forge will enable you to make XmlHttpRequests from a web page loaded over http to an https site. You will need to provide a Flash cross-domain policy file via your server to enable the cross-domain requests. Check out the blog posts at the end of the README to get a more in-depth explanation for how it works.

However, I should mention that Forge is better suited for requests between two different https-domains. The reason is that there's a potential MiTM attack. If you load the JavaScript and Flash from a non-secure site it could be compromised. The most secure use is to load it from a secure site and then use it to access other sites (secure or otherwise).

dlongley 2010-07-22 20:11:05

ansaurus

tags:

views:

answers:

Ajax http / https problem

related questions