具有相对URL的AJAX调用将通过HTTPS服务的网站的HTTP传递给

Question

We host our site on an IIS server behind a load balancer. The LB performs SSL offloading and everything behind it talks HTTP.

The issue is that AJAX requests in the served pages which point back to the same web server using relative URLs are attempting to connect over HTTP instead of HTTPS. This fails our CSP policies and usually wouldn't render anyway due to mixed content. If these URLs are resolved on the client's browser why would this be happening?

The URL currently looks like:

url: '/controller/someaction'

which on a page such as https://host/controller/action attempts to call http://host/controller/someaction

If we use protocol relative paths:

url: '//controller/someaction'

We lose the host completely and it attempts to call https://controller/someaction

There's an issue with setting upgrade-insecure-requests that currently causes an infinite redirect loop. This is a likely fix to the issue long term but adding that response header introduces more problems than it solves in the short term. There could be a hack involving ajaxSetup/beforeSend to modify the URL but that feels really dirty. We could go through the whole codebase and change URLs to 'https://' + windows.location.host + '/controller/someaction' but that feels dirty and time consuming.

A search shows that the behaviour could be different if the URL (either current or requested) ends with a '/' but experiments have shown that we see the same behaviour in all combinations.

Any idea why this is happening? We'd rather not change the SSL offloading behaviour but could if it's the only option.

Answer 1

我最好的猜测是，禁用SSL卸载将为您解决此问题，负载平衡器背后的服务器无法知道将使用HTTPS进行响应，浏览器将阻止HTTP响应并迅速发展。