HTTPS页面解决方案下的HTTP内容

Question

I'm having a website which a part of HTML is loaded from external, in this part, they defined some resource such as javascript or css and these resources will be a part of my website (for stylesheet or javascript interaction)

Unfortunately, my owned website is running under a HTTPS, and external part contains some resources under HTTP, it's not good practice because inside a HTTPS page, there are no insecure content allowed. I don't have right to change everything in external to https, so I have to give a solution for this issue, something I was thinking about that is building an engine for parsing all external content, and change all links in http to valid URL, however there are several issues because I don't know what content contained within it.

If you were me, what solution should be given?

Answer 1

Personally... I wouldn't use off-site content that i don't control on a page worthy of ssl-encryption (aka could be made malicious by a hacker or annoyed dev).

However, if you must do it, then your only option is some sort proxy, that parses the off-site content before being loaded into your page. If it's static, or at least doesn't change on every request, you could cache it to improve load times and save parsing it on every request.

That is of course assuming the off-site content cannot be made to use https anyway (can you just pass //offsite-com/script.js instead and the off-site content auto-detect whether to return any url's as https