Http content loaded in https connection

Question

My Webapp is running with a https connection / ssl certificate. I need to show pictures to the user. I get the links to the picture by an API request and link them afterwards. Sadly, the pictures address is http, so the browser shows that there are unsecure parts on the site, which mustn't be...

I could download the pictures and link to the proper picture afterwards, but I think this might be a little timeconsuming and not the best way to handle this.

Does somebody know a better solution for this? I'm using php, jquery and javascript.

Answer 1

You'll have to write a proxy on your server and display all the images through it. Basically your URLs should be like:

$url = 'http://ecx.images-amazon.com/images/I/51MU5VilKpL._SL75_.jpg';
$url = urlencode($url);

echo '<img src="/proxy.php?from=' . $url . '">';

and the proxy.php:

$cache = '/path/to/cache';
$url = $_GET['from'];

$hash = md5($url);
$file = $cache . DIRECTORY_SEPARATOR . $hash;
if (!file_exists($file)) {
    $data = file_get_contents($url);
    file_put_contents($file, $data);
}

header('Content-Type: image/jpeg');

readfile($file);

Answer 2

Ok, I've got a streaming example for you. You need to adapt it to your needs, of course.

Suppose you make a php file on your server named mws.php with this content:

if (isset($_GET['image']))
{
   header('Content-type: image/jpeg');
   header('Content-transfer-encoding: binary');
   echo file_get_contents($_GET['image']);
}

Look for any image on the web, for instance:

http://freebigpictures.com/wp-content/uploads/2009/09/mountain-stream.jpg

now you can show that image, as if it was located on your own secure server with this url:

https://<your server>/mws.php?image=http://freebigpictures.com/wp-content/uploads/2009/09/mountain-stream.jpg

It would of course be better to store the image locally if you need it more than once, and you have to include the correct code to get it from Amazon MWS ListMatchingProducts, but this is the basic idea.

Please don't forget to secure your script against abuse.