添加“微博秀”到网站中，由于因为网站是https协议，而微博秀默认是http，所以会导致“微博秀”不能正常显示。直接将微博秀源代码中的src属性http修改为https即可，但<iframe>依然会引用到http的链接。</p> <p>当HTTPS站点中含有HTTP链接的内容，Chrome浏览器则会在控制台提示“This content should also be served over HTTPS”提示。</p> <p>HTTPS 是 HTTP over Secure Socket Layer，以安全为目标的 HTTP 通道，所以在 HTTPS 承载的页面上不允许出现 http 请求，一旦出现就是提示或报错：</p> <p><code><span class="hljs-title">Mixed</span> Content: The page at <span class="hljs-string">'https://domain.com/w/a?id=074ac65d-70db-422d-a6d6-a534b0f410a4'</span> was loaded over HTTPS, but requested an insecure image <span class="hljs-string">'http://img.domain.com/images/2016/5/3/2016/058c5085-21b0-4b1d-bb64-23a119905c84_cf0d97ab-bbdf-4e25-bc5b-868bdfb581df.jpg'</span>. This content should also be served over HTTPS.</code></p> <p>很多运营对 https 没有技术概念，在填入的数据中不免出现 http 的资源，出现疏忽和漏洞也是不可避免的。</p> <p><strong>解决办法一：CSP设置upgrade-insecure-requests</strong></p> <p>W3C工作组考虑到了我们升级HTTPS的艰难，在2015年4月份就出了一个Upgrade Insecure Requests 的草案（<a href="http://www.w3.org/TR/mixed-content/">http://www.w3.org/TR/mixed-content/</a>），他的作用就是让浏览器自动升级请求。<br> 在我们服务器的响应头中加入：</p> <pre><code>server { ... add_header Content-Security-Policy upgrade-insecure-requests; ... } </code></pre> <p>我们的页面是 https 的，而这个页面中包含了大量的 http 资源（图片、iframe等），页面一旦发现存在上述响应头，会在加载 http 资源时自动替换成 https 请求。</p> <p>方法二、<br> 页面中加入 meta 头：</p> <p><code><span class="hljs-tag"><<span class="hljs-title">meta</span><span class="hljs-attribute">http-equiv</span>=<span class="hljs-value">"Content-Security-Policy"</span><span class="hljs-attribute">content</span>=<span class="hljs-value">"upgrade-insecure-requests"</span> /></span></code></p> <p>目前支持这个设置的还只有 chrome 43.0，不过我相信，CSP 将成为未来 web 前端安全大力关注和使用的内容。而 upgrade-insecure-requests 草案也会很快进入 RFC 模式。</p> <p>参考：<a href="https://segmentfault.com/a/1190000005057499">SegmentFault</a></p> <!--kg-card-end: markdown--> </div> <footer class="post-footer"> <div class="authors"> <a class="author-box" href="/author/leoskey/"> <img class="author-profile-image" src="https://static.blog.lcrun.com/2021/08/QQ图片20141003221445.jpg" alt="leoskey" /> <section class="author-box-content"> <div class="author-box-label">作者</div> <h5 class="author-box-name">leoskey</h5> <p>阅读更多文章</p> </section> </a> </div> </footer> <section class="post-full-comments"> <div id="disqus_thread"></div> <script> var disqus_config = function () { this.page.url = 'https://blog.lcrun.com/this-content-should-also-be-served-over-https/'; this.page.identifier = 'ghost-295'; }; (function () { var d = document, s = d.createElement('script'); s.src = 'https://blog-lcrun-com.disqus.com/embed.js'; s.setAttribute('data-timestamp', +new Date()); (d.head || d.body).appendChild(s); })(); </script> </section> </section> <script> var images = document.querySelectorAll('.kg-gallery-image img'); images.forEach(function (image) { var container = image.closest('.kg-gallery-image'); var width = image.attributes.width.value; var height = image.attributes.height.value; var ratio = width / height; container.style.flex = ratio + ' 1 0%'; }) </script> </div> </main> <div id="sidebar"> <div class="inner"> <nav id="menu"> <ul class="links"> <li class="nav-lcrun "><a href="https://blog.lcrun.com/">LCRUN</a></li> <li class="nav-zi-yuan "><a href="https://blog.lcrun.com/resource/">资源</a></li> <li class="nav-fei-zao "><a href="https://blog.lcrun.com/friends/">肥皂</a></li> <li class="nav-guan-yu "><a href="https://blog.lcrun.com/about-me/">关于</a></li> </ul> </nav> <section> <div class="mini-posts"> <article> <h3><a href="/gai-lu-chou-jiang-suan-fa/">概率抽奖算法</a></h3> <p>/// <summary> /// 抽奖 /// </summary> /// <param name="probabilities">每个奖项的概率&</p> </article> <article> <h3><a href="/c-de-zhi-chuan-di-he-yin-yong-chuan-di/">C#的值传递和引用传递</a></h3> <p>在 C# 中，形参到底是值传递还是引用传递？ 在 Eentity Framework 中，会遇到一个场景：使用 DbContex 的 Savechanges 方法后，entity</p> </article> <article> <h3><a href="/ru-he-zai-mariadbzhu-cong-mo-shi-zhi-xing-cong-ku-hong-fa-qi/">如何在MariaDB主从模式执行从库触发器</a></h3> <p>在默认设置下，从库不会自动执行触发器。如何解决这个问题？ MariaDB设置项目slave_run_triggers_for_rbr，官方文档：Running Triggers on the Slave for</p> </article> </div> </section> <footer id="footer"> <p> 本网站由 <a href="https://www.upyun.com/?utm_source=lianmeng&utm_medium=referral" target="_blank" rel="noopener noreferrer"> <img src="/assets/upyun_logo.png?v=0406b5a4a6" style="height: 2rem;position: relative;bottom: -10px;" alt="" srcset=""> </a> 提供CDN加速/云存储服务 </p> <p class="copyright"> <a id="icp" href="https://beian.miit.gov.cn/"></a> © 懒 - All rights reserved </p> </footer> </div> </div> </div> <style> #search-container { position: fixed; top: 0; left: 0; width: 100%; height: 100%; z-index: 99999; } #search-container #search-cover { position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(0, 0, 0, .5); } #search-container #search-form { margin: 2em auto; width: 60%; max-width: 600px; position: relative; } #search-container #search-form #search-field { display: block; width: 100%; margin: 0 auto; border-radius: .375em; border: 0; font-family: "Roboto Slab", serif; font-size: 1em; font-weight: 700; color: #f56a6a; height: 3.5em; letter-spacing: .075em; line-height: 3.5em; padding: 0 2.25em; } #search-container #search-form #search-field:focus { outline: none; } #search-container #search-form #search-results { display: block; overflow-y: scroll; position: absolute; width: 100%; max-height: 500px; background: rgba(255, 255, 255, .9); padding: 0 2em; border-radius: .375em; } </style> <div id="search-container" style="display: none;"> <div id="search-cover"></div> <div id="search-form"> <form> <input id="search-field" autocomplete="off" /> </form> <section id="search-results"></section> </div> </div> <script src="/assets/main/js/jquery.min.js?v=0406b5a4a6"></script> <script src="/assets/main/js/browser.min.js?v=0406b5a4a6"></script> <script src="/assets/main/js/breakpoints.min.js?v=0406b5a4a6"></script> <script src="/assets/main/js/jquery.ghosthunter.js?v=0406b5a4a6"></script> <script src="/assets/main/js/util.js?v=0406b5a4a6"></script> <script src="/assets/main/js/main.js?v=0406b5a4a6"></script> <script src="/assets/main/js/site.js?v=0406b5a4a6"></script> <script src="https://cdn.bootcss.com/prism/1.16.0/prism.min.js"></script> <script src="https://cdn.bootcss.com/prism/1.16.0/components/prism-csharp.min.js"></script> <script src="https://cdn.bootcss.com/prism/1.16.0/components/prism-javascript.min.js"></script> <script> var ICP = '鄂ICP备16000692号-1'; $(function(){ // 新标签页打开外链 $('a').each(function(index, item){ var href = $(item).attr('href'); if(href.indexOf(window.location.origin)!==0&&href[0]!=='/'){ $(item).attr('target', 'blank'); } }); }); </script> <script> var _mtac = {}; (function() { var mta = document.createElement("script"); mta.src = "//pingjs.qq.com/h5/stats.js?v2.0.4"; mta.setAttribute("name", "MTAH5"); mta.setAttribute("sid", "500725715"); var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(mta, s); })(); </script> </body> </html>
