IE8 security warning

Question

On a https site that I am working on, I keep getting "Do you want to view only the webpage content that was delivered securely?. This webpage contains content that will not be delivered using a secure HTTPS connection, which could compromise the security of the entire webpage."

I made sure the site has relative links. Form actions are relative as well. All the image src is relative too.

This popup only happens in IE8, IE7 does not do anything. Works fine in Firefox too.

Any ideas what could be happening? If I click Yes, and look at the source code, it's exactly the same as when I see it when I click No.

Is this some new IE8 bug?

Answer 1

It has to do with content on the https site that is on a regular http connection. Its probably a script that you are not needing to use the page and so it's not interferring with anything.

Not a bug, but with IE7 you've probably told it to remember your setting (of yes display the info) and so you are not getting it anymore.

Answer 2

Try using Fiddler to see exactly what is being downloaded in your session. This will be very useful as it can capture downloads triggered by scripts, analytics, etc.

---

I used fiddler on your page and found that WebResource.axd isn't being loaded with https. This is probably included because of an AJAX library like ASP.NET AJAX.

This page describes your problem precisely and if it doesn't explicitly resolve it for you, it should at least give you some direction.

Answer 3

I was having the same problem. My culprit turned out to be the following line and in particular the src="javascript:void(0)" attribute.

document.write('<script type="text/javascript" id="contentLoadTag" defer="defer" src="javascript:void(0)"><\/script>');

This line was used in a OnDocumentReady javascript function like in this link: http://www.javascriptkit.com/dhtmltutors/domready.shtml

Hope that helps someone!