Find non-secure http request being sent on secure page triggering IE6 "non-secure items notice"

Question

I have a page that is under SSL.

However, in IE6, I get a notification:

"This page contains both secure and non-secure items" etc.

I've looked at all the HTTP requests for that page in both Firebug and Wireshark, and non of it seems to be sent over plain HTTP, all the resources are being fetched over SSL/TLS. However, IE6 still gives the non-sure items notification.

The filter I am using in Wireshark to filter Firefox is:

http.user_agent eq "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"

For IE Only:

http.user_agent eq "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; WOW64; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; MS-RTC LM 8; MALC)"

---

Update:

All three network protocol analysers (Wireshark, Fiddler, Charles) show that all the requests are over HTTPS. IE6, 7 and 8 all show the "non-secure content" warning. Anyone have any idea if there is something else triggering IE?

---

Update 2:

It turns out it is tied to some JavaScript:

document.write("<script type='text/javascript' id=__ie_onload defer src=javascript:void(0)><\/script>");

This is specific for IE to emulate window.domReady event. The src=javascript:void(0) is what is triggering IE to show the insecure notice.

Now I'd like to replace javascript:void(0) with an equivalent that doesn't trigger the insecure notice.

These also triggered insecure:

javascript:;
about:blank;

This errored a version of IE:

#
''

Any ideas?

Fore reference here is the full JS file: http://closure-compiler.appspot.com/code/jscbfa82c39e2e310e33f1786fb9a83f9ee/default.js

Answer 1

Try Fiddler, that has worked for me in the past. Especially with IE6!

Answer 2

I prefer Charles, but any web debugging proxy, Fiddler included, should help out. Using Charles you can record the web requests and then simply filter for 'http://'

Answer 3

I just used an empty JS file as the src of the JS. Though it is an extra https request, it works for now.