在使用SSL的网站上通过HTTP加载外部JavaScript文件

Question

What are potential drawbacks of loading an external widget over HTTP when my website is accessible over HTTPS ?

<!-- https://www.example.com -->
<script src="http://www.external-source.com/widget.js"></script>

Are any warnings going to be displayed to the user? Any way to suppress them? Will this script be loaded in all times?

EDIT:

What happens when we load an external JS over HTTPS, but with non-commercial certificate? Will the warnings be shown?

Answer 1

Loading a script with plain (insecure) http inside a secure (https) site completely defeats the security of the site. Therefore most modern browsers will simply refuse to load the script without any warnings and without giving the user a way to enforce the loading.