htaccess Elite

This page contains both secure and nonsecure items.

Do you want to display the nonsecure items?

Mixed SSL Content Warning Secure Fixed

I used to run into the problem of having warning messages pop up when I accessed a page with secure and non-secure information and finally I found something that let me post non-ssl encrypted content on an ssl encrypted page and no warning messages will pop up!

On on of my secure sites, lets say https://www.askapache.com/htaccess/ I wanted to give my visitors the option to post youtube videos and google videos. But then everyone kept seeing the “warning, mixed secure/non-secure contentâ€

produke wrote:

This page contains both secure and nonsecure items.

Do you want to display the nonsecure items?

Mixed SSL Content Warning Secure Fixed

I used to run into the problem of having warning messages pop up when I accessed a page with secure and non-secure information and finally I found something that let me post non-ssl encrypted content on an ssl encrypted page and no warning messages will pop up!

On on of my secure sites, lets say https://www.askapache.com/htaccess/ I wanted to give my visitors the option to post youtube videos and google videos. But then everyone kept seeing the “warning, mixed secure/non-secure contentâ€

Fix for warning: page contains secure and nonsecure items




I run a secure phpBB forum that ONLY operates on port 443, SSL is required or the connection is denied. My users started requesting the ability to post youtube and google videos within the post.

I installed the [2.0.19] Youtube Video BBCode and the [2.0.21] Google Video and everthing worked perfectly, until I tested the feature in my browser and got the following warning message:

This page contains both secure and nonsecure items.

Do you want to display the nonsecure items?

AHH! How annoying. So I went about looking for a workaround for this and finally came up with my own solution, that is very easy.

Open includes\bbcode.php

Find

Code: Select all

   // [email]user@domain.tld[/email] code..
   $patterns[] = "#\[email\]([a-z0-9&\-_.]+?@[\w\-]+\.([\w\-\.]+\.)?[\w]+)\[/email\]#si";
   $replacements[] = $bbcode_tpl['email'];

After Add

Code: Select all

    // [youtube]YouTube URL[/youtube] code..
    $patterns[] = "#\[youtube\]http://(?:www\.)?youtube.com/watch\?v=([0-9A-Za-z-_]{11})[^[]*\[/youtube\]#is";
$replacements[] = $bbcode_tpl['youtube'];
   
   
    // [GVideo]GVideo URL[/GVideo] code..
    $patterns[] = "#\[GVideo\]http://video.google.com/googleplayer\.swf\?docid=([0-9A-Za-z-_]*)[^[]*\[/GVideo\]#is";
    $replacements[] = $bbcode_tpl['GVideo'];

    // [GVideo]GVideo URL[/GVideo] code..
    $patterns[] = "#\[GVideo\]http://video.google.com/videoplay\?docid=([0-9A-Za-z-_]*)[^[]*\[/GVideo\]#is";
    $replacements[] = $bbcode_tpl['GVideo'];

Find

Code: Select all

   $text = preg_replace($patterns, $replacements, $text);

After Add

Code: Select all

   $text = str_replace("http://www.youtube.com/", "https://example.com/lounge/youtube/", $text);

   $text = str_replace("http://video.google.com/videoplay", "https://example.com/lounge/googleplayer.swf", $text);
   $text = str_replace("http://video.google.com/", "https://example.com/lounge/", $text);

Now heres the cool part, in your sites root web-accessible folder http://www.example.com/ add an .htaccess file with the following:

Code: Select all

RewriteEngine On
RewriteBase /
RewriteRule ^lounge/googleplayer\.swf(.*)$ http://video.google.com/googleplayer.swf$1 [L]
RewriteRule ^lounge/youtube/(.*)$ http://www.youtube.com/$1 [L]

and it worked!

But one caveat, this wouldn’t turn the warning messages off in IE < version 7, so I added some simple HTML to the head of all my pages that only shows up for people using IE < version 7.

Code: Select all

<!--[if lt IE 7]>
<span id="ie7">Please Upgrade:
<a href="http://www.microsoft.com/windows/ie/downloads/default.mspx?mg_id=10013">IE 7!</a>
<a href="http://www.mozilla.com/en-US/">FF!</a></span>
<![endif]–>

Cool huh! Can anyone help me clean up the code that I am including in bbcode.php? As you can see I don't really understand how to do the replacing in the most efficient way..

Original Solution: Fix for secure and nonsecure items warning message and AskApache.com blog


Its really not specific per-say, to any MODs. I just happed to demonstrate the use with 2 mods. It could just as easily work to allow non-ssl images to be displayed without a warning, by rewriting https to http.


The crux of this thread is the ability to remove the "This page contains both secure and nonsecure items" warning message when including non-ssl content over an ssl connection.

This technique centers around the use of mod_rewrite and modifying the bbcode.php file to rewrite non-ssl address to local ssl addresses, then the rewrite rules in htaccess internally rewrite the bbcode rewritten ssl urls to the correct urls, but it happens internally so that the warning message is never displayed. This also has some security benefits acting as a layer of abstration between the non-ssl content and the visitor requesting the content.

I really would like help improving the way I am replacing stuff in bbcode.php but for the life of me I can't seem to find the correct forum to post this?? :) help :)

Hello, I'm trying to wrap my head around this technique. First of all I tried it with a local XAMPP (http://www.apachefriends.org/en/xampp.html) and it didn't work. Now I have two teories of what this might actually do (if one gets it to work):

- it returns a 302 (temporary moved) or 301 (permanently moved) redirect to the client. I tried both of these methods (by creating a PHP file which generated the redirects) and the warnings of mixed contents still appeared.

- it acts as mod_proxy (it fetches the document for you and forwards it). I could not find any indication of this behavior in the mod_rewrite documentation.

So how does it do it?

Ok I just checked the access logs from the https site that I use this on.

/.htaccess

Code: Select all

RewriteEngine On
RewriteBase /
RewriteRule ^lounge/googleplayer\.swf(.*)$ http://video.google.com/googleplayer.swf$1 [L]
RewriteRule ^lounge/youtube/(.*)$ http://www.youtube.com/$1 [L]

https access_log

Code: Select all

IP - usern [07/Jan/2007:04:54:24 -0800]
"GET  /lounge/youtube/v/S5Ev19NsDQ4 HTTP/1.1" 302 634  https://domain.com/lounge/viewtopic.php?p=77188"

So a user on the forum types this

Code: Select all

[youtube]http://www.youtube.com/watch?v=S5Ev19NsDQ4&mode=related&search=[/youtube]

Which gets rewritten via phpBB as

Code: Select all

https://domain.com/lounge/youtube/v/S5Ev19NsDQ4

Which is what the browser requests.

Then when the browser requests

Code: Select all

https://domain.com/lounge/youtube/v/S5Ev19NsDQ4

from the domain.com server, the rewrites in the .htaccess file transparently change the request to

Code: Select all

http://www.youtube.com/v/S5Ev19NsDQ4

Notice in the rewritecode I used [L] but not [R] this means perform the request transparently. Do not issue a 302 or 301 or whatever message, just serve the content. Very similar to a proxy.

Unfortunately that is all I can explain at this point, To be 100% accurate in my explanation I would need to use Wireshark or ethereal and look at the http protocol.. but To do that with SSL I would need to use a SSL proxy that I just don't have time to setup, let me know if you figure anything out or need more info on my server environment, etc..

Maybe I should also mention this little tidbit from the same .htaccess file.

Code: Select all

SSLOptions +StrictRequire
SSLRequireSSL


This may be the key, i dunno.. See This SSL article that I wrote about this code snippet. tell me what you think.