Web site aggregation with twitter widget SSL issue

Question

Hello!

I'm seeking for solution how to isolate widget included by partial to main site. Issue appear when user access site with https. Ie 6,7 shows security confirmation dialog (part of website resources are not in secure zone). First of all I download twitter widget on our side, also I download all CSS and pictures. Then I patched widget JS to point onto downloaded resources. But still has not luck with security warning :( I guess the reason of this issue is AJAX request to twitter, but there is no idea how to sole it. (Just to create some kind of proxy on our side).

Thank you for attention.

Answer 1

You can use a sniffer like HttpWatch to debug this--watch the requests going by and see which ones start with http instead of https. It may be possible to just change the urls you use to point to https://twitter.com, not sure about how your widget works.

Answer 2

I got the Twitter Widget to work over HTTPS (SSL) by doing the following:

1. Save every image, css, and javescript file on my local webserver

2. Changed every "http" to "https" in the javascript AND in the css

3. The last piece was tricky. https://twitter.com/statuses/user_timeline.json brings back data that already includes "http"; namely avatars and the profile image. So, I found about four places in widjet.js that used the user_timeline.json data. I hardcoded an image url where ever that "http" data was used. Searching "src" will located all of those places.

It's an ugly fix, but it worked.

Answer 3

Hi.. I kind of used your fix, but modified it slightly. I don't want to link to https://twitter.com, I just need the images, css and js to be delivered securely, so I selectively re-replaced any href="https references in the widget.js file with href="http

Seems to have worked well, doesn't cause any errors, and my users don't have to wait ten times as long when they click my Twitter profile link because I chose to send them to https twitter

Answer 4

Hi, thanks Keshar, worked for me. I came to the same conclusion that all http requests had to be https to prevent the IE security warning and also display the twitter feed. I used the live HTTP headers firefox plugin which helps for showing any non-secure http requests, such as the JSON requests.

Jon