The page at [url] ran insecure content from [url] in chrome

Question

When i open a link this shows following message in chrome [blocked] The page at https://www.loadmytrailer.com/beta/postload.php ran insecure content from http://code.jquery.com/ui/1.10.2/jquery-ui.js. but run fine in firefox.

[I googled it and found that when your site run on Secure SSL then it blocked some insecure content from external http sources. ]

So i want to loads these insecure content anyway in chrome Please guys help me .

Solution 1

You can use protocol-relative URLs.The browser will use the page's protocol to try to obtain the file. On non-secure pages- http. On secure pages it will use https.

For example, instead of:

http://code.jquery.com/ui/1.10.2/jquery-ui.js

...you can use:

//code.jquery.com/ui/1.10.2/jquery-ui.js

! notice absence of protocol

Solution 2

That's impossible. Chrome's security policy won't allow that.

Option 1:

Host the javascript you want to load remotely by yourself and link to it relatively.

<script type="text/javascript" src="/my/assets/js/jquery/1.10.2/jquery.min.js"></script>

Requesting a resource on your own server is protocol-independent

Option 2:

Use CDN's that support SSL. (Google for example)

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>

A relative protocol notation can be used to request the source with the proper protocol depending on the protocol the current resource is using (see above).

---

Side Note

There is a command line parameter for Chrome called "-allow-running-insecure-content", which skips the insecure content check.

I highly advise not to use it because you can't expect your users to have set that parameter.

---

Further Reading

• Google Chrome Help - "This page has insecure content"

Solution 3

For testing purposes, you could activate loading of insecure content by clicking the "shield" icon which would appear on the address bar in chrome.

Comments

[thpl]

No problem. I just did a quick search. For developing purposes you can also use the command line flag: "-allow-running-insecure-content" to skip the insecure content check. Nevertheless I will not add it to my answer because I wouldn't even reccomend it for developing purposes. If your problem is solved flag the answer as correct please.

[MRVDOG]

and how do we enable something like mydomain.co.uk:8000/socket.io/socket.io.js on the domain mydomain.co.uk, where socket.io isn't ssl

[Synetech]

That did the trick! This issue was confounding me. A userscript I had written a while back which required loading some data from gdata.youtube.com on pages at youtube.com was throwing the blocked-content error in recent versions of Chrome. I looked at numerous methods during my research to fix it, but this was the simplest and easiest solution. Instead of using command-line switches or making the script more promiscuous (i.e., matching anything with youtube in the URL), deleting just five characters fixed it. Plus, it made the underlying protocol mismatch problem clear. Thanks.