0

I have a web site mostly access through regular HTTP and a login page running over a secure connection (HTTPS) for obvious security reasons (nobody likes to their multi-purpose duplicate passwords running in plain text over the internet :-).

This setup works fine, but I get this annoying popup in IE:

Do you want to access only the secured content on this page?

This web page contains content which will not be acessed using a secure HTTPS connection. This presents a security risk for the entire web page.

Yes / No / More information

(Caveat: this is my own translation from French, so the actual wording my be different in English).

The thing is, this page is not even accessing any JavaScript resources or anything. The only resources it's accessing are the CSS stylesheet and a PNG logo.

There is no apparent "don't ask me again" option. How do I disable this warning (preferably only for this web page) or prevent it from appearing?

Acceptable solutions include modifying the web page itself or local settings in the browser. I don't normally use IE, but I still find this annoying while testing.

Note: I know the obvious solution is to serve the static content over HTTPS, but I'd prefer not having to do that.

Improve this question

1 Answer 1

Reset to default
3

This warning is there for a reason. Serving any content over HTTP to a HTTPS webpage potentially compromises the entire security behind SSL.

You say that you're not accessing javascript resources, but you're forgetting of course that CSS pages can embed javascript, and the fact that images can be resized by attackers to confuse the layout of the SSL page.

The solution for you is to either inline the CSS and images into the page, or to serve all of the static content over SSL.

Alternatively if you don't really care about security, you might as well turn off SSL on the login page altogether, as you're not really protecting the user's credentials as it is, which is the reason why IE is warning you.

Improve this answer
4
  • Excuse my ignorance, but your second sentence seems to imply some "obvious" that I'm not aware of. Can you link to a good resource that explains why this statement is true in general? (Chrome does not give such a warning, does Microsoft know something that the chromium developers don't?) And I obviously care about security, or else I wouldn't go through the trouble of setting up the SSL configuration :-)
    – André Caron
    Mar 5, 2012 at 21:08
  • Here you go: richnetapps.com/using_javascript_expressions_in_css
    – SecurityMatt
    Mar 5, 2012 at 21:11
  • Sorry, I was referring to the second sentence: "Serving any content over HTTP to a HTTPS webpage potentially compromises the entire security behind SSL".
    – André Caron
    Mar 5, 2012 at 21:50
  • 1
    Content served over HTTP is potentially modifyable by an attacker. Any Javascript served over HTTP to a HTTPS site means that a javascript backdoor that captures and posts back details added into a form. CSS includes javascript, flash has similar problems and images can be used to re-layout the page by swapping small images for large ones. As a general rule, if any part of the page is served over HTTP, the page isn't secure.
    – SecurityMatt
    Mar 5, 2012 at 22:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .