I have a web site which is served over an https protocol. This is written in angularJs. The Website is calling an asp.net web api service over http, and then I'm getting this error:
angular.js:10765 Mixed Content: The page at 'https://example.com/forms/#/question-set-4#topOfThePage' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://webapiaddress/api/ControllerName/GenerateCaptcha'. This request has been blocked; the content must be served over HTTPS.(anonymous function) # angular.js:10765r # angular.js:10558g # angular.js:10268(anonymous function) # angular.js:14792$eval # angular.js:16052$digest # angular.js:15870$apply # angular.js:16160g # angular.js:10589T # angular.js:10787w.onload # angular.js:10728
angular.js:10765 XMLHttpRequest cannot load http://webapiaddres/api/SomeController/GenerateCaptcha. Failed to start loading.
So the error suggests for me that I should serve the web api self host over an https addres. So in the config of that web api self host I'm changing it to https//webapiaddres/
But then I'm getting this:
angular.js:10765 GET
https:/webapiaddress/api/SomeController/GenerateCaptcha
net::ERR_INSECURE_RESPONSE
What am I doing wrong? Why is this happening. Strange thing is that that this does not scream that I don't have CORS enabled, but this could be because of the fact that this web api selfhost and the site is on the same server. I can't find any simmilar problem to mine in google.
I've managed to solve the problem with my colleage and it was very simple. It did not came up at first glance. I've ran the address of the web api in the chrome browser and there there was an request for accepting an certificate. When I did that everything went smooth. This is the work for our administrator not from the code, but this was quite interesting experience.
Related
Hi I have a react application that runs on vercel so in https and the backend is on a vps, the backend has no https and when I run the rest calls from frontend to backend I have the following error how do I solve it?
Error:
xhr.js:220 Mixed Content: The page at 'https://vmgroupfrontend.vercel.app/#/login' was loaded over HTTPS, but requested an insecure
XMLHttpRequest endpoint 'http://myendpoint.org:3001/user/login'.
This request has been blocked; the content must be served over HTTPS.
I'm doing application with spring security and Spring MVC in back end and Angular in front end.
My problem is that I do the logged in correctly, but the problem in logged out I implemented correctly in my localhost: http://localhost:8080 worked without problem. When I change it to https:// I get this error:
Mixed Content: The page at '' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint ''. This request has been blocked; the content must be served over HTTPS.
I want to know how to correct that? And how to know which url blocked by https in the browser for example chrome?
This post which gives a solution to your problem: http://www.learningthegoodstuff.com/2015/08/mixed-http-error-with-spring-security.html
All the details are explained there, basically all you have to do is add this two lines to my application.properties file:
server.tomcat.remote_ip_header=x-forwarded-for
server.tomcat.protocol_header=x-forwarded-proto
I fixed by removing a forward slash from the end of a URL fixing everything.this is help me : GET request throws error after app implemented SSL: Mixed Content: This request has been blocked; the content must be served over HTTPS"
This happens when the server is using http (non secured). You can fix it by enforcing https for all resources in the backend. Check here for more details.
In #Jabir Minjibir's answer there is very good link to describe the error. As sum up, when your application works with httpS scheme you can't make visits to unsecure links which is http.
I got this error and fixed it like I wrote below:
Mixed Content: The page at 'https://stackblitz.com/' was loaded over HTTPS, but
requested an insecure XMLHttpRequest endpoint 'http://172.19.0.62:920/'.
This request has been blocked; the content must be served over HTTPS.
You can mask unsecure links with simple-https-proxy npm package. In my experience I was coding an angular sample on httpS://stackblitz.com and I was trying to connect to an Elasticsearch server which doesn't have a domain name. I needed to make it working with ssl but I couldn't modify it's scheme. Thus I installed a proxy which can work secure (httpS).
I installed the npm package:
npm i -g simple-https-proxy#latest
Then I created certificate:
simple-https-proxy --makeCerts=true
Then I ran it
simple-https-proxy --target=http://172.19.0.62:9200 --port=9201 --rewriteBodyUrls=false
In another example:
Im using Bootstrap and AngularFire for my Web project. Everything ok but when I host it on Firebase.com. The layout has changed
Errors:
Mixed Content: The page at 'https://......firebaseapp.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css'. This request has been blocked; the content must be served over HTTPS.
Mixed Content: The page at 'https://......firebaseapp.com/' was loaded over HTTPS, but requested an insecure script 'http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js'. This request has been blocked; the content must be served over HTTPS.
What happens with Bootstrap? Thanks in advance!
Firebase uses HTTPS to serve content. As you can see from the error, you are referring the content to be loaded over HTTP. Though this should not be happening, but it could be one of recent features of Chrome where they block, non-secure requests over a secure channel.
In order to solve it, you should change the URLs in your code to point at HTTPS versions of Bootstrap CDN.
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js
Further Read: https://support.google.com/chrome/answer/1342714?hl=en
I was having the same issue:
you just need to make the http to https
in the bootstrap link inside the code.
That will resolve the issue.
I'm using OpenFire with the REST API plugin installed.
I'm attempting to get a list of chat rooms through an AngularJS $http call to http://localhost:9090/plugins/restapi/v1/chatrooms
with the proper Authorization header set in the $http.defaults.headers.common property.
When the call is made, I get the following error:
OPTIONS http://localhost:9090/plugins/restapi/v1/chatrooms 401 (Unauthorized)(anonymous function) # angular.js:10722sendReq # angular.js:10515serverRequest # angular.js:10222processQueue # angular.js:14745(anonymous function) # angular.js:14761Scope.$eval # angular.js:15989Scope.$digest # angular.js:15800(anonymous function) # angular.js:16028completeOutstandingRequest # angular.js:5507(anonymous function) # angular.js:5784
XMLHttpRequest cannot load http://localhost:9090/plugins/restapi/v1/chatrooms. Response for preflight has invalid HTTP status code 401
The truly annoying issue is, that when I build the same request through Postman, it works perfectly and the expected response is received but inside the browser (whether through $http, or a call to window.fetch through the console) I keep getting that error.
Supposedly, the OpenFire REST API supports CORS (I went so far as to check the plugin source code), but nothing seems to help.
I'm the developer of REST API plugin. You are right that the REST API supports CORS, and it is possible to call it directly from angular js. The mentioned problems (preflight request) will by done by your browser. I just fixed the issue that the OPTION request don't need to auth.
Checkout the REST API version: 1.1.7
I suggest you to compare the fiddler request and the browser request (headers + body).
It should work if they are 100% identical..
Mixed Content: The page at 'https://www.example.com/dashboard' was
loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint
'http://api.example.com/inventory/10/'. This request has been blocked;
the content must be served over HTTPS.
We have this Angular web app that runs with Flask on the back-end.
Everything was working fine until we implemented SSL. Afterwards, we keep getting this strange error everywhere.
Now, the $http.get request in my dashboard.js is definitely calling "https://api.example.com/inventory/10" in the code below and yet the error is claiming that we are trying to request "http" instead.
$http.get($rootScope.baseUrl+'/inventory/' + item.id)
where rootScope.baseUrl is "https://api.example.com".
It's really weird because some GET requests ARE going through from our web application to our back-end, but some requests are throwing this weird error.
Here's the header that gets an error in our Network tab of the console in chrome.
Request URL:https://api.example.com/inventory/10 Request Headers
Provisional headers are shown Accept:application/json, text/plain, /
Origin:https://www.example.com
Referer:https://www.example.com/dashboard
It was a weird case that came down to removing a forward slash from the end of a URL fixing everything. Somehow, whenever we made a GET request using $http in Angular like baseurl + inventory.id + "/", it would make a http request but as soon as remove that slash, it would make the https request correctly.
Still so confused
I think the root of the problem is in server redirects. I was able to resolve same issue with SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') setting for Django (its running behind AWS balancer). Here is documentation.