IE8 and “Img that was delivered securely” warning

Question

In my https application I am loading some images. If Img src is not available I will show the default image - I got this js that will do the job for IE also:

$(document).ready(function(){
  $("img").each(function(index) {
    $(this).error(function() {
      this.src = "/shared/ts/web/images/missing_img.gif";
    });
    $(this).attr("src", $(this).attr("src"));
  });
});

It works great with IE10, but with IE8 I have a security warning:

Do you want to view only the webpage content that was delivered securely?

If I click on yes -> I cannot see the missing_img.gif, if I click on no everything is ok.

Can you tell me why am I getting this warning and what can I do to remove it? I don't want to change the client default IE8 settings.

Answer 1

From the looks of it you are not delivering that particuar image via https. Any resource that is not delivered by https can potentially be modified or read by an attacker whilst in transit. This will throw errors in some browsers, whilst others (such as Chrome) will 'cross out' your 'https' bit in the url to show that not all elements are secure.

To fix it, make sure that all the resources you deliver are via https. So in this case you might want to force it by doing

this.src = "https://mysite.com/shared/ts/web/images/missing_img.gif";

I'm not entirely sure why this isn't automatically using https. Maybe someone else can enlighten you on that one.

Answer 2

It's because your image (because you didn't specify https:// as protocol) gets the http:// protocol..

Since this on your secure site, it'll try to load " http://domain.com/shared/ts/web/images/missing_img.gif " and that's "not secure content on a secure site"

I think you can fix this by either make the path absolute (include the entire part of it including https://your-domain.com ), or use "//" (double slashes) and omit the http(s): part, so it'll take the same protocol as the site (https when the site is secure, http otherwise).