TeX rendering is broken on sites like Math and Physics when viewed over SSL.
For example:
3 Answers
When accessing one of our MathJax enabled sites via the HTTPS protocol, we now use the CDN specified by the MathJax FAQ:
How do I access the MathJax CDN using a https secure connection?
The MathJax CDN utilizes Rackspace’s CDN service. Unfortunately, this currently does not offer https support for the default address cdn.mathjax.org. However, as an alternative, you can use the following unmapped address:
https://c328740.ssl.cf1.rackcdn.com/mathjax/latest/MathJax.js
While not as appealing as cdn.mathjax.org, this address is stable and safe to use. For more information, see our documentation.
So everyone should now be able to enjoy the beauty of quality mathematics notation whichever protocol they prefer.
answered Mar 18, 2014 at 20:00
-
According to cheap's comment, this has been switched to
//mathjax-cdn.storage.googleapis.com/mathjax/...on March 29th?– ArjanCommented Apr 5, 2014 at 10:05 -
@Arjan It turned out to be an experiment; the URL was switched back next day. Commented Apr 5, 2014 at 23:00
-
1In the end they switched to
//cdn.mathjax.orgfor both http and https. Commented Sep 28, 2014 at 17:37
As pointed out by Davide Cervone above, MathJax CDN does support HTTPS as long as you use the hostname c328740.ssl.cf1.rackcdn.com instead of cdn.mathjax.org. Yes, that looks a bit uglier, but that's all "under the hood".
Thus, this bug can be fixed by replacing the URL:
http://cdn.mathjax.org/mathjax/latest/MathJax.js
with:
https://c328740.ssl.cf1.rackcdn.com/mathjax/latest/MathJax.js
on pages served over HTTPS.
Alas, the ugly hostname works only for HTTPS, so protocol-relative URLs can't be used here.
Edit: While waiting for the SE devs to fix this, I managed to find a way to work around the problem with a user script. Basically, the following code will reload MathJax over SSL if it failed to load normally:
if ( 'https:' == location.protocol && 'undefined' === typeof(MathJax) ) {
var mjs = $('script[src^="http://cdn.mathjax.org/"]').remove();
if ( mjs.length > 0 ) $.ajax( {
dataType: "script", cache: true,
url: mjs[0].src.replace('http://cdn.mathjax.org', 'https://c328740.ssl.cf1.rackcdn.com')
} );
}
(There are a bunch of tricky little issues here that made this hard to solve, like the fact that MathJax tries to be clever and find its own base URL by searching the DOM for script tags; if the original script tag isn't removed, MathJax will thus try to load its submodules over HTTP and fail.)
I've incorporated this code, along with several other minor fixes, into something I'm calling the Stack Overflow Unofficial Patch. Please give it a try and let me know if you find any issues.
answered Jan 13, 2014 at 11:57
-
Not sure if protocol-relative URLs work anyway. But you can easily embed
httpscontent in a page served viahttp, just not the other way ’round, so just switching tohttpsfor MathJax always will work. (Thanks for linking my question with this one here.) Commented Jan 13, 2014 at 16:32 -
@mirabilos protocol relative URLs do actually work - linking to
//example.com/file.jswill go tohttp:// ...if the page is being viewed over http, andhttps:// ...if viewed over https. However, you're right that just defaulting to the secure version wouldn't be a problem.– nhinkleCommented Jan 13, 2014 at 16:35 -
@nhinkle It depends how you define "wouldn't be a problem," it's a performance penalty at the very least– Nick Craver ModCommented Jan 14, 2014 at 16:37
-
@NickCraver where is the performance penalty? Maybe on the server side, but it's a CDN, so it shouldn't be too much of a problem. On the client side, decoding SSL is a minimal impact. Perhaps due to caching, but how likely is the user to have MathJax cached from another site anyways? Caching can still be done with https, too. Am I missing an aspect? And besides, if the goal is to eventually move Stack Exchange entirely onto https, does it matter if a small portion (MathJax) is moved over early?– nhinkleCommented Jan 15, 2014 at 1:48
-
@nhinkle HTTPS requires 2 additional round-trips to the termination point on the handshake, for some users that's quite a bit...and the reason SE won't be SSL by default until we have much more local terminations. It's about latency, not processing power, and the penalty is quite large.– Nick Craver ModCommented Jan 15, 2014 at 1:50
-
2@NickCraver fair enough. In that case, would it be possible to detect the protocol server-side and embed the proper URL? It's a fairly negative user experience to have unrendered LaTeX on the page.– nhinkleCommented Jan 15, 2014 at 3:51
-
5@nhinkle yes it is, I'm concerned about their SSL link though, going to talk to MathJax guys before using it. Some places block some CDNs, this is also a concern, and was a deal breaker with akami for example. Remember that we don't support SSL yet, the negative user experience is by choice. There's still a lot of mixed-content work to be resolved in the coming months.– Nick Craver ModCommented Jan 15, 2014 at 11:11
For folks who are getting this bug because they're using HTTPS Everywhere, I've pushed a rule to fix this by rewriting the MathJax CDN: https://github.com/EFForg/https-everywhere/commit/a9b1a4cf448d67eb62c869712b778454e902d62a. However, this won't actually fix anything unless you've turned off active mixed content blocking in your browser; Firefox and Chrome have (IMO, incorrectly) implemented mixed content blocking in such a way that the blocker fires before HTTPS Everywhere can rewrite resources to SSL. :(
Firefox bug for reference: https://bugzilla.mozilla.org/show_bug.cgi?id=878890
Ugh! Until that bug is fixed, I would recommend turning off the HTTPS Everywhere rule when you need to TeX (click on the icon in the addons bar, select the "Stack Exchange (partial)" rule to toggle on/off).
PS: This answer should really also go in https-everywhere breaks MathJax due to https/http mixed-content rules but I don't have sufficient reputation to add it there.
-
1Seems this works for any site using MathJax, nice. Just in case you missed it: for Stack Exchange, this rule is no longer needed since March 18th. (See the accepted answer.)– ArjanCommented Apr 5, 2014 at 10:02
https://cdn.mathjax.orgisn't correct, so it's probably not going to be loaded even if they SE changes it.httpsaccess:https://c328740.ssl.cf1.rackcdn.com/(see the MathJax FAQ for details).