views:

30

answers:

1

I'm getting the good ole' "This page contains both secure and nonsecure items." dialog in IE when connecting to an HTTPS site. No big deal... I've just got something coming in over a non-secure connection so that should be an easy fix, right?

So I go into "View > Web Page Privacy Policy..." to look to see where I've included an HTTP file, and this is what I see...

https://blah/path/to/file.htm
https://blah/path/to/file.js
http://blah:443/path/to/file.css

Um... ok... so... there is an HTTP only URL being requested, but it is going over port 443 ("https://blah/" is shorthand for "http://blah:443/" EDIT: No it's not, actually [see slugster's answer/my comments below]) so...

What is the deal with this!? IE 7.0.5730.13 can't possibly be THAT stupid, can it?

Is there an IIS setting that needs to be tweaked?

+2  A: 

You've specified the port, but you have also specified the protocol as normal (non-secure) http. It isn't IE being stupid - you are expecting it to cover for your mistake.

This is normally the result of using an absolute path somewhere in your code instead of a relative path.

slugster
Yep, one of my server guys just said the same thing! It was my (incorrect) understanding that "http://blah:443/" was shorthand for "https://blah/" in in fact they (HTTP and HTTPS) are two distinct protocols.Muchos Danke!
Campbeln
Now I guess the question is... why don't the other browsers complain? (Though I see now that FF does say the connection is "... partially encrypted")
Campbeln
Oh... as to the cause... I have a central "BaseURL" function that was written without looking to see if the connection was secure or not, as again I figured specifying the port was enough.Agh, fruit of the poisonous tree =)
Campbeln