Steps as of Chrome v91 (6/17/2021): Click the Not secure warning next to the URL Click Site settings on the popup box Near the bottom of the list is Insecure content, change this to Allow Close settings, go back to the site, and Refresh the page Older Chrome Versions: timmmy_42 answers this on: https://productforums.google.com/forum/#!topic/chrome/OrwppKWbKnc In … Read more
This should always work even when $_SERVER[‘HTTPS’] is undefined: function isSecure() { return (!empty($_SERVER[‘HTTPS’]) && $_SERVER[‘HTTPS’] !== ‘off’) || $_SERVER[‘SERVER_PORT’] == 443; } The code is compatible with IIS. From the PHP.net documentation and user comments : Set to a non-empty value if the script was queried through the HTTPS protocol. Note that when using … Read more
I think this is due to the connection established with the client machine is not secure. It is due to the fact that you are talking to an HTTP server, not an HTTPS server. Probably you didn’t use the correct port number for HTTPS.
Please use HSTS (HTTP Strict Transport Security) from http://www.hanselman.com/blog/HowToEnableHTTPStrictTransportSecurityHSTSInIIS7.aspx <?xml version=”1.0″ encoding=”UTF-8″?> <configuration> <system.webServer> <rewrite> <rules> <rule name=”HTTP to HTTPS redirect” stopProcessing=”true”> <match url=”(.*)” /> <conditions> <add input=”{HTTPS}” pattern=”off” ignoreCase=”true” /> </conditions> <action type=”Redirect” url=”https://{HTTP_HOST}/{R:1}” redirectType=”Permanent” /> </rule> </rules> <outboundRules> <rule name=”Add Strict-Transport-Security when HTTPS” enabled=”true”> <match serverVariable=”RESPONSE_Strict_Transport_Security” pattern=”.*” /> <conditions> <add input=”{HTTPS}” pattern=”on” ignoreCase=”true” … Read more
I’ve just attempted this – I needed to test some development code on my localhost Apache on Windows. This was WAAAY more difficult than it should be. But here are the steps that managed to work after much hairpulling… I found that my Apache install comes with openssl.exe which is helpful. If you don’t have … Read more
Ryan, thanks for pointing me in the right direction. I fleshed out your answer (2nd paragraph) a little bit with some code and it works. In this scenario these code snippets are put in my express app: // set up plain http server var http = express(); // set up a route to redirect http … Read more
Digest Authentication communicates credentials in an encrypted form by applying a hash function to: the username, the password, a server supplied nonce value, the HTTP method and the requested URI. Whereas Basic Authentication uses non-encrypted base64 encoding. Therefore, Basic Authentication should generally only be used where transport layer security is provided such as https. See … Read more
I tested it thoroughly before publishing. Of all the browsers available to test against on Browsershots, I could only find one that did not handle the protocol relative URL correctly: an obscure *nix browser called Dillo. There are two drawbacks I’ve received feedback about: Protocol-less URLs may not work as expected when you “open” a … Read more
As of 2010, all modern, current-ish browsers cache HTTPS content by default, unless explicitly told not to. It is not required to set cache-control:public for this to happen. Source: Chrome, IE, Firefox.
You need URL Rewrite module, preferably v2 (I have no v1 installed, so cannot guarantee that it will work there, but it should). Here is an example of such web.config — it will force HTTPS for ALL resources (using 301 Permanent Redirect): <?xml version=”1.0″ encoding=”UTF-8″?> <configuration> <system.webServer> <rewrite> <rules> <clear /> <rule name=”Redirect to https” … Read more