[I] Favicon Mixed Content: The page at 'https://example.com:1340/users/xxx' was loaded over HTTPS, but requested an insecure favicon 'http://ip:9080/uploads/branding/5nPxxxxxE.png'. This request has been blocked; the content must be served over HTTPS. [answer]

Sat, 01 Feb 2025 06:05:59 -0800 


goody-good opened a new issue, #1240:
URL: https://github.com/apache/answer/issues/1240

   # Mixed Content Security Issue
   
   ## Issue Description
   Security warning detected: Mixed Content loading blocked by browser
   
   The page `https://example.com:1340/users/xxxxx` is attempting to load 
resources over an insecure HTTP connection while the main page is served over 
HTTPS.
   
   Specifically:
   - Main page (secure): `https://example.com:1340/users/xxxxxxx`
   - Favicon (insecure): `http://ip:9080/uploads/branding/5xxxxxKE.png`
   
   ## Impact
   - Browser blocks the insecure resource loading
   - Favicon not displaying properly
   - Potential security vulnerabilities due to mixed content
   - Degraded user experience
   
   
   ## Steps to Reproduce
   1. Deploy Answer Forum
   2. Use Caddy to deploy Answer with HTTPS
   3. Open browser developer tools (F12)
   4. Check console for mixed content warnings
   
   ## Environment
   - Protocol: HTTPS
   - Resource Type: Favicon
   - Error Type: Mixed Content Blocking
   - Caddyfile
   ```
   example.com:1340 {
       reverse_proxy 127.0.0.1:9080
       tls {
           protocols tls1.2 tls1.3
       }
   }
   ```
   - docker-compose.yaml
   ```
   version: "3.7"
   services:
     caddy:
       image: caddy
       restart: unless-stopped
       ports:
         - "1339:80"
         - "1340:443"
         - "1340:443/udp"
       volumes:
         - $PWD/Caddyfile:/etc/caddy/Caddyfile
         - $PWD/caddy_data:/data
         - $PWD/caddy_config:/config
       network_mode: host
   ```
   
   ## Priority
   Medium - While not causing critical functionality issues, this should be 
addressed to ensure proper security standards and user experience.
   
   ## Labels
   - security
   - mixed-content
   - favicon
   - https


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to