Problem of import js file in https page in IE8

Question

It seems that in IE8, if the page using https protocol needs to import a .js file, the .js file also needs to use the https protocol.

<script type="text/javscript" src="http://xxx/yourjs.js"&gt;&lt;/script&gt;

works in all browsers except IE8

<script type="text/javscript" src="https://xxx/yourjs.js"&gt;&lt;/script&gt;

works in all browsers

I am using a usercontrol which imports several .js files. This means that if one page uses https protocol, then I have to alter the usercontrol so that all imported .js files are using https protocol.

How do you resolve this issue?
How do you comment on this IE8 behavior?

Answer 1

Using this on HTTPS

<script type="text/javscript" src="http://xxx/yourjs.js"&gt;&lt;/script&gt;

should throw up a warning to the user in all browsers - I'd expect IE8 to do the same but maybe it's a new "feature" to silently ignore it.

You should use the same protocol that the request is on, or failing that always HTTPS (though this will be slower for the user and put more load on your server).

You could specify the URL without the scheme - that should use the current one (http or https):

<script type="text/javscript" src="//xxx/yourjs.js"></script>

Edit: Found the reference saying this is valid: RFC 2396

 relativeURI   = ( net_path | abs_path | rel_path ) [ "?" query ]

A relative reference beginning with two slash characters is termed a
network-path reference, as defined by in Section 3. Such
references are rarely used.

Answer 2

Are you sure this isn't related to the use mixed content security setting?

It might be worth checking your browser settings, to see what the zone you're running in is set to.

To be honest though, I like the websites I go to, to be consistent, so I would like your javascript files to be retrieved via https.

Answer 3

This is correct behaviour. You don't want non-secure resources to be a part of your secure page. In previous versions of IE a warning was displayed, but I guess the feeling is that too many people just said "go ahead" without knowing what the implications were. The error is now silent. You can adjust your security settings, but that will only fix your browser (and as I mentioned, it's not a good idea).

Make sure your page resources are all secure on your secure pages. (Images, Iframe sources, scripts... the lot!)