Quite often I see a mixed content warning when looking at an SE chat room:

Mixed content warning

This is typically caused by images linked in chat hosted on an HTTP source, not an HTTPS one like the SE Imgur account. Sometimes it is also caused by oneboxing of external content (this particular example is from a onebox of the official SE blog; the blog is HTTPS, but the generated one-box isn't).

It shouldn't be possible for a user to submit content to chat that triggers inclusion of insecure content, creates this warning, and potentially compromises the security HTTPS provides.

  • 1
    I could not reproduce the bug that causes a mixed content warning when oneboxing posts from stackoverflow.blog. How can I reproduce this? – Sonic the Reinstate Monica-hog Feb 25 '18 at 13:55
  • I can't reproduce it either. https connections to the blog onebox, http connections do not. Is there a specific link that reproduces it? – Zoe Feb 25 '18 at 14:10
  • @RougetheBat the source is in a private chat room, so I can't link it here. I created the same entry in the sandbox now: chat.stackexchange.com/transcript/message/43055441#43055441 – Mad Scientist Feb 25 '18 at 14:15
  • @MadScientist I mean the URL. Which blog post is it? – Zoe Feb 25 '18 at 14:18
  • 1
    And it's reproduced. It seems to be a problem with that specific image (though there could be more somewhere) – Zoe Feb 25 '18 at 14:25
  • i.stack.imgur.com/fpfkw.gif gif can repro, in animated gif. – Journeyman Geek Feb 25 '18 at 14:32
  • @PrincessLuna just onebox any image which isn't hosted on a site with https. – Shadow The Princess Wizard Apr 23 '18 at 9:28

You must log in to answer this question.

Browse other questions tagged .