Loading external JavaScript files over HTTP on website that uses SSL

Question

What are potential drawbacks of loading an external widget over HTTP when my website is accessible over HTTPS ?

<!-- https://www.example.com -->
<script src="http://www.external-source.com/widget.js"></script>

Are any warnings going to be displayed to the user? Any way to suppress them? Will this script be loaded in all times?

EDIT:

What happens when we load an external JS over HTTPS, but with non-commercial certificate? Will the warnings be shown?

It depends on the Browser settings. If you're really concerned about warnings being shown to the user, why not host the file yourself? — haim770
– haim770, Commented Sep 23, 2014 at 7:42
Can you tell me more? I cannot host it on my server because this file is dynamically generated. — dev9
– dev9, Commented Sep 23, 2014 at 7:44
See developer.mozilla.org/en-US/docs/Security/MixedContent/… for more info on the problem. As for the solution: i'd use Reverse Proxy. — haim770
– haim770, Commented Sep 23, 2014 at 7:50

Steffen Ullrich · Accepted Answer · 2014-09-23 08:00:12Z

1

Loading a script with plain (insecure) http inside a secure (https) site completely defeats the security of the site. Therefore most modern browsers will simply refuse to load the script without any warnings and without giving the user a way to enforce the loading.

answered Sep 23, 2014 at 8:00

Steffen Ullrich

125k11 gold badges155 silver badges194 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Loading external JavaScript files over HTTP on website that uses SSL

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related