Why am I suddenly getting a “Blocked loading mixed active content” issue in Firefox?

I found this blog post which cleared up a few things. To quote the most relevant bit:

Mixed Active Content is now blocked by default in Firefox 23!

What is Mixed Content?
When a user visits a page served over HTTP, their connection is open for eavesdropping and man-in-the-middle (MITM) attacks. When a user visits a page served over HTTPS, their connection with the web server is authenticated and encrypted with SSL and hence safeguarded from eavesdroppers and MITM attacks.

However, if an HTTPS page includes HTTP content, the HTTP portion can be read or modified by attackers, even though the main page is served over HTTPS. When an HTTPS page has HTTP content, we call that content “mixed”. The webpage that the user is visiting is only partially encrypted, since some of the content is retrieved unencrypted over HTTP. The Mixed Content Blocker blocks certain HTTP requests on HTTPS pages.

The resolution, in my case, was to simply ensure the jquery includes were as follows (note the removal of the protocol):

<link rel="stylesheet" href="//code.jquery.com/ui/1.8.10/themes/smoothness/jquery-ui.css" type="text/css">
<script type="text/javascript" src="//ajax.aspnetcdn.com/ajax/jquery.ui/1.8.10/jquery-ui.min.js"></script>

Note that the temporary ‘fix’ is to click on the ‘shield’ icon in the top-left corner of the address bar and select ‘Disable Protection on This Page’, although this is not recommended for obvious reasons.

UPDATE: This link from the Firefox (Mozilla) support pages is also useful in explaining what constitutes mixed content and, as given in the above paragraph, does actually provide details of how to display the page regardless:

Most websites will continue to work normally without any action on your part.

If you need to allow the mixed content to be displayed, you can do that easily:

Click the shield icon Mixed Content Shield in the address bar and choose Disable Protection on This Page from the dropdown menu.

The icon in the address bar will change to an orange warning triangle Warning Identity Icon to remind you that insecure content is being displayed.

To revert the previous action (re-block mixed content), just reload the page.

Related Posts:

  1. How to redirect all HTTP requests to HTTPS
  2. ndroid 8: Cleartext HTTP traffic not permitted
  3. Any any insecure http:// URLs left in wordpress?
  4. Specific Page/Post Need to Stay Non SSL
  5. Should a 502 HTTP status code be used if a proxy receives no response at all?
  6. What is the difference between a URI, a URL and a URN?
  7. HTTP Status 504
  8. What is the difference between POST and GET? [duplicate]
  9. Do I need Content-Type: application/octet-stream for file download?
  10. Problem HTTP error 403 in Python 3 Web Scraping
  11. application/x-www-form-urlencoded or multipart/form-data?
  12. Problem HTTP error 403 in Python 3 Web Scraping
  13. application/x-www-form-urlencoded or multipart/form-data?
  14. Is 418 “I’m a teapot” really an HTTP response code?
  15. How to define the basic HTTP authentication using cURL correctly?
  16. “Cannot GET /” with Connect on Node.js
  17. @ converted to %40 in HTTPPost request
  18. What’s the difference between a POST and a PUT HTTP REQUEST?
  19. What’s the difference between using application/csv vs text/csv? [duplicate]
  20. What are all the possible values for HTTP “Content-Type” header?
  21. What is the difference between PUT, POST and PATCH?
  22. What’s the difference between “Request Payload” vs “Form Data” as seen in Chrome dev tools Network tab
  23. Exception in thread “main” java.net.NoRouteToHostException: No route to host
  24. Error `sec_error_revoked_certificate` when viewed in Firefox only
  25. Can PHP cURL retrieve response headers AND body in a single request?
  26. Setting Curl’s Timeout in PHP
  27. How are parameters sent in an HTTP POST request?
  28. wget: unable to resolve host address `http’
  29. Are HTTP headers case-sensitive?
  30. Https to http redirect using htaccess
  31. When looking at the differences between X-Auth-Token vs Authorization headers, which is preferred?
  32. WordPress HTTP parameter pollution
  33. Does WordPress send data about your blog to WordPress.org or Automattic?
  34. Hiding WordPress REST API v2 endpoints from public viewing
  35. Why is WordPress redirecting from http to https on a local environment?
  36. Switch from https back to http
  37. Chrome Version 44.0.2403.89 m is trying to force HTTPS
  38. Is there a way to force ssl on certain pages
  39. Does WordPress only support HTTP 1.1?
  40. force http canonical tag on https pages
  41. Upgrade to SSL Breaks Admin Dashboard
  42. Redirect www to non-www htaccess
  43. Remove HTTP: from the site URL and just keep // in it
  44. How are both HTTP and HTTPS versions displaying?
  45. WordPress – https : Css and Js files are not working (load on http instead of https)
  46. Redirect from https to http or from http to https? [closed]
  47. Is curl required?
  48. Cant Access Website – Changed HTTP to HTTPs
  49. The resource was preloaded using link preload but not used within a few seconds
  50. Why Better WP security plugin returns 418 I’m a Teapot “error”?
  51. Access general settings trough wordpress files
  52. using wp_remote_get to retrieve own url on local host
  53. Divert http to https with WordPress on IIS
  54. How can I make uploaded images in the editor load with HTTPS?
  55. Using wp-cron in backpress – problems with wp_remote_post, fsockopen error
  56. Enable CORS in wordpress
  57. No ‘Access-Control-Allow-Origin’ header is present [closed]
  58. Redirect HTTP to HTTPS for all sub domains (blog posts)
  59. Changing HTTP to HTTPS
  60. How to use https on one page only?
  61. WordPress changing script source from https to http
  62. Change port of wordpress
  63. All content is HTTPS, but browsers warn of HTTP mixed content [closed]
  64. How to get value of custom http header?
  65. Several times request to load plugins when sending one request
  66. How to make my site use HTTPS for images or how to insert images as relative paths?
  67. why is $_REQUESt[‘redirect_to’] empty?
  68. 404/500 error on content images if Referer header is from another domain [closed]
  69. My site doesn’t redirect from HTTP to HTTPS
  70. https to https problem – 404 and can’t login
  71. Need workaround for insecure XMLHttpRequest endpoint request
  72. Broken css on mobile phones only on https
  73. Get “HTTP/1.1 406 Not Acceptable” when accesing my website with Delphi Indy Control
  74. Redirecting specific sites to HTTP in WordPress Multisite
  75. Plesk login inaccessible after changing site URL
  76. Why does WordPress uses HTTPS for JS, CSS on EC2
  77. mixed contents admin panel is Unsecured
  78. Moving wordpress site from HTTP to HTTPS ERR_TOO_MANY_REDIRECTS
  79. Implications of not completing all tasks when switching to HTTPS
  80. https rewrite not working for All in one security Brute force > rename login url
  81. Redirect HTTP request to HTTPS request
  82. WordPress HTTP 500 Error “page isn’t working”
  83. Navigation Bar displays vertically on Mozilla
  84. Moving site from HTTP to HTTPS
  85. How to switch static files back to using HTTP instead of HTTPS?
  86. My site thinks it’s secure when it is fact not
  87. CSS/JS is not working in multi lang installation
  88. WordPress HTTPS – ‘… better to use HTTP for installation …’
  89. Any idea on how to fix this error when forcing SSL on a certain page?
  90. how to server over http and https with one installation
  91. Nice font not working when http to https – SSL Issue
  92. Duplicator live to wamp https to http
  93. Whole website redirected to httpa but in dashboard settings still http
  94. Is it bad to redirect http to https?
  95. For what is the “.well-known”-folder?
  96. Human readable format for http headers with tcpdump
  97. How to make wireshark filter POST-requests only?
  98. Changing my URL in General Settings cause the site to crash
  99. Development to production, how to move a development site from http + dev.example.com to a production site https + example.com?
  100. How to force HTTP and stop SSL completey on WordPress website

Leave a Comment