loading http javascript in https javascript

Question

I have a web application which has root html and this html (say index.html) loads some java script. This application is accessible through https and I want to load one java script which is exposed over http.

https://mydomain/index.html contains this line of code:

<script src="http://unsecure/custom.js" type="text/javascript"/>

When I try to run my application thorugh IDE everything works fine but problem happens when I bundle my application in war file and run it. It fails to load the included java script by saying:

[blocked] The page at https: //mydomain/ ran insecure content from http: //unsecure/custom.js.

Is there any way to load this unsecure javascript or do I need to publish this unsecure javascript through a secure way and then access it (can change this included java script protocol from http to https)?

Answer 1

All content which is used by a site, which is accessed through HTTPS, must use HTTPS as well, otherwise you get this warning.

The reason for this: If not all content of a HTTPS site is HTTPS, the browser can't tell that the site is "secure" and therefore gives the user a warning.

Answer 2

You could either do below two things:

1) Download it over your local and create war. Then you would be using relative path.

2) Place in some https location.

If its a third party library and you do not have control on the frequent changes that would happen for this library, you could ask them to put it in https. Majority of the times hosted JS would be both http and https too.