2

Can I create exemptions in the major Windows browsers (IE, Firefox, Chrome, Safari) for the insecure content warnings you get when mixing https and http on the same page?

WE have a site that needs to run https... it allows students here to pay their bills online, sign up for classes, view their grades, housing, finincial aid etc, and allows faculty to view appropriate student information (FERPA protected). Site content should istelf pretty much never be seen over vanilla unencrypted http.

One of the features of this site is that it's also a portal. Students can chat, post to message boards (for sale, rides home, etc), and — through iframes — setup "gadgets". There are a few default gadgets embedded, such as a print use counter, facebook (to encourage use of the portal), library card catalog lookup, and others, and students can set up their won — and some of these do not support https at all. We do know that students are actually using this site regularly, and it loads as the home page in our computer labs.

Unfortunately, this leads to nasty warnings about mixing secure and insecure content. I know what these warnings are, why they have them, and why they are important (XSS vulnerabilities could potentially let rogue javascript in a gadget upload student info to a remote server). That said, I also control the deployment of these sites, so for my own managed computers I can know that this content is okay.

This brings me to the my question. For our college-owned computers, at least, I would like to disable the warnings in IE, Firefox, Safari, and Chrome, for just that specific insecure content and in just those specific pages where we've included it. I definitely don't want to disable these blocks and warnings generally. I'm only talking about the specific content in question, some of which is based on vendor software that I can't just set to use https. Is this possible?

1
  • > some of which is based on vendor software that I can't just set to use https => sure you can, just stick a reverse proxy (via nginx, haproxy, apache httpd, etc.) in front of it as a TLS termination proxy. As long as you can select the URL to use for these 'gadgets', you can point them at the proxy (and point the proxy at the HTTP server).
    – Bob
    Dec 23, 2016 at 2:27

2 Answers 2

3

For our college-owned computers, at least, I would like to disable the warnings in IE, Firefox, Safari, and Chrome, for just that specific insecure content and in just those specific pages where we've included it. Is this possible?

As far as I know, there's no way to do this in Firefox or Chrome.

You can allow insecure content from certain websites in Internet Explorer, but you can't restrict that exception to the specific pages where you included it.

Here's how:

  1. Open Internet Options (Alt, T, O) and switch to the Security tab.

  2. Select Trusted sites.

  3. Click Custom level....

  4. In Miscellaneous, search for Display Mixed Content and select Enable.

  5. Click OK twice, then Sites.

  6. Uncheck **Require server verification (https:) for all sites in this zone.

  7. Add the websites that provide the insecure content to the zone.

    For example, https://xkcd.com requires a CSS file from http://imgs.xkcd.com, so you'd add http://imgs.xkcd.com to the zone of trusted sites.

  8. Click Close, then OK or Apply.

That being said, I think you're attacking this problem the wrong way. The major browsers are getting increasingly pedantic about mixed content, and that trend is unlikely to change. Even if you could disable the warnings for the college-owned computers, that still wouldn't solve the problem on every other computer. While some users might have those warnings entirely disabled (the red and crossed https: is warning enough for me), all others will be in for a horrible browsing experience.

The only way to truly solve this problem would be to change the website's design:

HTTP-where-possible approach

Switch the entire website to HTTP and reserve HTTPS for the content that actually needs it.

For instance, there's really no need to chat while you're paying a bill. The billing section could do well without any extra gadgets.

Other sensitive information could be displayed in inline frames or be pulled/pushed with AJAX. The latter option – of course – would still display nasty warnings to users with JavaScript disabled, but I suppose most of the gadgets require it anyway, so they could just be removed in the fallback version.

HTTPS-where-possible approach

Keep using HTTPS for the entire website and deal with the insecure content on a case-by-case basis.

You mentioned that some run in inline frames. If the main URLs of the inline frames use HTTP, those won't generate mixed content warnings, as scripts from the inline frame can't affect the parent frame.

If there's some content left that can be neither confined to an inline frame nor retrieved via HTTPS, the only option would be to route it through your servers, i.e., set up a script that downloads certain insecure content when requested and forwards it to the user via HTTPS.

Frames approach

If neither of the above options is possible, you could place the entire content in an inline frame or use AJAX navigation.

The greatest flaw of this approach could be amended by changing the the URL the address bar displays with JavaScript (window.history.pushState('Object', 'Title', URL);).

While this is still less than perfect, it would make the site at least browsable. Chrome displays the mixed content warning only once per tab. Firefox and Internet Explorer display it every time you click a link.

1
  • Sadly, this is a vendor-built site, so a redesign isn't possible. I also forget to mention that the login controls show on every page, with no way to replace them with a link to a dedicated login page that can be encrypted. Thus, the only way to be sure of secure authentication is for every page to use https (they should be fixing this in an upcoming version). I'll dig more into your notes about iframes, though. I was sure the site was already using iframes, but if that's not the case I may be able to make my own insecure pages elsewhere and include them via iframe. Aug 2, 2012 at 14:17
1

could you pop up the chat in another (unsecure) window?

otherwise, you may have to add exceptions through policies - for IE, this Reg file

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]  
@=""  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\superuser.com]  
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\superuser.com\www]  
"http"=dword:00000002 

will add www.superuser.com to the trusted locations

1
  • 1
    Is adding it to trusted locations good enough? I think it will still warn about the mix of http and https, even though the http is "trusted" Aug 1, 2012 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .