23

Many SE sites (like math.SE) have a problem with mixed content, which causes display bugs in recent browsers. This is particularly evident with math.SE (because of the huge use of MathJax) and with chat sections.

Will this be fixed?

How to reproduce

Visit math.SE or chat.SE

What happens

Mixed content is blocked, output is missing pieces of code (MathJax):

Missing MathJax

This picture also includes my main Firefox addons (top right), it relevant. It shows missing styles:

Missing style

The white on the left is my tab list.

  • 1
    You need to be more specific with your question. If you are reporting a bug, describe the bug in detail and include steps to reproduce it. – user102937 Jan 13 '14 at 23:48
  • 1
    See my answer to a similar question on meta.math.SE that provides a Greasemonkey script that you can use to load MathJax from its https URL when the main page is from an https URL. – Davide Cervone Jan 14 '14 at 13:04
  • @DavideCervone please rewrite your comment as an answer, for future reference – miniBill Jan 14 '14 at 13:54
  • 1
    OK, I have repeated my answer here. – Davide Cervone Jan 14 '14 at 18:29
8

If you are using https: to access Math.SE, then since MathJax is loaded from an http: URL, this will lead to the "blocking mixed access content" message that you have identified above.

I have created a Greasemonkey script that will load MathJax from the CDN's https: address in this case (but will do nothing if you are using http:). You need to have Greasemonkey installed (See this post for pointers to Greasemonkey and work-alikes for other browsers). Once it is installed, clicking on the following link should ask if you want to install the user script.

Let me know if this script doesn't work for you. I have tested in with Firefox 26 on Mac OS X, but it should work on other browsers and OS's.

19

Don't use HTTPS, we don't fully support it yet. A valid SSL cert is the first step in SSL support, not a flag for it being complete. I'd make a list of what all mixed content is in play, but I'm not sure our max post length is enough.

We intentionally don't link you to HTTPS anywhere that doesn't support it yet...if your browser extensions do so, they need adjusting.

  • (a side note: the certificate isn't valid for meta.math.SE, you probably want to fix that) – miniBill Jan 14 '14 at 0:11
  • @miniBill That's one of the problems, you can't get a cert for *.*.stackexchange.com. – Undo - Reinstate Monica Jan 14 '14 at 0:14
  • 1
    Ouch, would that mean getting a cert for each meta? – miniBill Jan 14 '14 at 0:15
  • @miniBill: or moving metas to *.meta.stackexchange.com; see nickcraver.com/blog/2013/04/23/… – Matt Jan 14 '14 at 7:27
  • Why is HTTPS available anyway when it's not fully supported? Perhaps it's just me, but I have this feeling that lately the amount of posts here related to that extension is getting ridiculous. – Stijn Jan 22 '14 at 16:40
  • @Stijn because it's a prerequisite – Nick Craver Jan 22 '14 at 17:27
  • 1
    I don't understand what you mean, a prerequisite for what? Either you completely support HTTPS and you put it live, or you don't and keep it to your testing area, no? (Not a rant, just wondering) – Stijn Jan 22 '14 at 18:15
  • 2
    Someone should really yell at and/or submit a PR to HTTPS Everywhere to stop this crap. I find their claim that they only accept tested rules dubious considering this causes a lot more problems than just mixed content. – Tim Stone Jan 23 '14 at 0:21
  • @TimStone I'm the maintainer of HTTPS Everywhere. We generally do test important rules in the dev branch before releasing as stable, but I made an exception for StackExchange because the Tor folks told me that HTTPS was blocking the release of tor.stackexchange.com. (Note that Tor Browser comes with HTTPS Everywhere by default.) – Yan Z Apr 5 '14 at 7:26
  • @NickCraver I'll readily admit that HTTPS Everywhere is causing lots of these problems; I added much more SSL support in the rule for StackExchange in the last release at the request of Tor devs (see comment above), but it seems that mixed content errors are rampant. Do you know when full SSL support is coming? – Yan Z Apr 5 '14 at 7:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .