Linux blocking browser request alert method on browser

On the browser page of the Linux system, the http request is not allowed. If there is an http request, an error will occur and the Linux system will alert the user. This article will introduce the Linux system to block the http request alert on the browser page.

Alert Code

Mixed Content: The page at ‘https://www.taobao.com/‘ was loaded over HTTPS, but requested an insecure image ‘http://G.alicdn.com/s.gif’. This content should also be served over HTTPS.HTTPS

After the transformation, we can see the following alarms in many page:

Many operators no technical concepts to https, fill in In the data, http resources are inevitable, the system is huge, and negligence and loopholes are inevitable.

Solution

CSP Settings upgrade-insecure-requests

Fortunately, the W3C Working Group has considered the difficulty of upgrading HTTPS. In April 2015, an upgrade was made. The draft of Insecure Requests, his role is to let the browser automatically upgrade the request.

Add in our server's response header:

header(“Content-Security-Policy: upgrade-insecure-requests”);

Our page is https This page contains a large number of http resources (images, iframes, etc.). Once the page is found to have the above response header, it will be automatically replaced with an https request when the http resource is loaded. You can view google provide a demo:

But people understand is that this resource was issued two requests, speculation is achieved browser bug:

Of course, if we don't have trouble working on the server /Nginx, we can also add a meta header to the page:

"meta http-equiv=“Content-Security-Policy” content=“upgrade-insecure- Requests” /"

Currently only chrome 43.0 is supported for this setting, but I believe that CSP will be the focus of future web front-end security. The upgrade-insecure-requests draft will soon enter the RFC model.

From the example given by the W3C working group, it can be seen that this setting does not process the a link of the foreign domain, so you can use it with confidence.

The above is the introduction of the Linux system to block the http request alert on the browser page, because the actual application can easily appear http request in the page, so if you do not block the alarm, it will always be displayed there. More impact on the user experience.