Page contains both secure and nonsecure items

Question

I'm working on a legacy web application - frames and a mixture of html, asp and aspx. The entire site is https.

For some strange reason when I hit a specific page I get the magic message that says the Page contains both secure and nonsecure items. (IE obviously doesn't want to tell me what those resources are) I have checked the page that's being loaded and there are absolutely no http://... links - everything is relative links. I have fired up fiddler and checked what's being requested - everything looks fine.

I am completely at wit's end here. I have absolutely no idea why I'm getting this message, but it's completely screwing with the site.

How do I track down the underlying cause?

Answer 1

If you have any hidden frames loading pages for some data transfer - check they aren't getting a 404 as this will trigger IE to see and http request.

Answer 2

Using a tool like Charles or Fiddler it should be possible to see all traffic and detect the problem. I actually had a similar issue a while back and mine was caused my a minified version of prototype/scriptaculous i was using so it could be worth trying to remove any javascript and go from there if nothing else is apparent.

Answer 3

Some ideas:

1. Do you have an iframe which is set to load the "about:blank" URL rather than an actual blank HTML page. IE will see about: url as not being part of the secure site.

2. Are you using any IE hacks which involve the CSS "behavior" style? This is an MSIE-specific feature which is used by a number of hacks to get IE to be more compatible with modern standards. They load HTC files, but there are some quirks and unusual rules around how IE handles them with respect to the rest of the page environment.

3. Do you have an third-party stats apps on your site (google analytics, etc)? Have you checked that they are loading via https?

4. Do you have any Javascript or CSS which includes subsequent files?

5. Have you tried it in other browsers which might have better tools for analysing the site than IE6? (IE8 has a very handy 'Developer Tools' feature, though I still think Firefox + Firebug is the best browser debug tool available)