Help with SSL Vulnerability (Mixed Content)?

Question

Hey guys I have my own webserver that is hosting a website that I recently installed/setup a self-signed SSL cert. Securing the website seemed to go fine, but in firefox and IE I sometimes get pop up boxes that say something along the lines of "There is a mix of secure and insecure information on this page..." and in the firefox error console it says something about being possibly susceptible to an SSL vulnerability (CVE-2009).

1. Is this truly a vulnerability I should be worrying about?
2. Does anyone know what might be causing the problem/how I can fix whatever is causing the problem?

Answer 1

Hi Joe,

the mixed context warning is caused by loading some content (images, scripts, css, iframes, ...) using http. The easiest way to find these is to open the source code view in the browser and search for "http://".

This is truly an security issue: If an attacker can manipulate a script or css file, he can modify any part of your page (for example change the target of a login form). And even images are an issue because they can display instructions misleading the user.

I guess that you are referring to CVE-2009-3555: This is not related to the mixed content warning. And you can ignore it for now, assuming your webserver is using the newest security updates:

Unfortunately, when using the present, flawed SSL/TLS protocol version, it is not possible to determine whether a site is protected or vulnerable.

https://wiki.mozilla.org/Security:Renegotiation

Answer 2

Another good way to isolate HTTP vs. HTTPS requests is via fiddler - you should see right away which files, if any, are requested of your site without SSL.

The requests should have the HTTP REFERER header set, which can help find out why those resources are requested over HTTP instead of HTTPS.

One obscure issue will occur if your web site uses IFRAMEs, where the content is set at run-time. Having no content in the IFRAME (an empty source tag) will cause IE to think that it's not a resource protected by HTTPS, so you'll get the warning even though no content actually got transmitted over HTTP.

Answer 3

It can be a security problem. See http://www.sslshopper.com/article-stop-the-page-contains-secure-and-nonsecure-items-warning.html for information on how to fix it.

Answer 4

Basically you're serving up HTTP content somewhere on the page, be it an image, a CSS file or something else. One of the nicest ways to fix this is to use protocol relative URLs; they have the form of

"//example.com/image.gif"

for example

<img src="//example.com/image.gif" />

This has the effect of loading the resources using the protocol the hosting page has, http if it's http, https if it's https.

Fiddler is great for tracking these things down as the protocol for resources is clearly shown in the UI;