: User contributed images on a HTTPS site without mixed content warnings I have a forum where, like most forums, users can post images. I've set up HTTPS across the site, but of course most

@Yeniel560

Just realised that I never posted my solution. The answer provided in Stephen's comment is what solved it for me. In short, I created a proxy script that does the following:


If the image is https, leave it alone.
If the image is http and from a site known to support https (e.g. my own site, imgur.com etc) then rewrite to https.
Otherwise if the image is http, rewrite it to use example.com/imgproxy?img=ORIGINALURL&hash=KEY

Then the proxy script fetches the HTTP image, caches it locally, and outputs the image data. On repeated requests it outputs the cached data directly. The linked SO answer describes the security hash and other details.

Vote Up Vote Down

@Debbie626

It's not possible to have insecure resources in a secure page, and not get the mixed content warning.

For user agents that support it, the upgrade-insecure-requests directive is an instruction to attempt to load the resource over https or fail trying.

Other user agents will ignore the directive, continuing to load the insecure resources.

Here is an article on the Google Developers site discussing this and other options.

Vote Up Vote Down