如何查看安全页面上的不安全项目
我有一个网络应用程序，在我自己的机器上运行得很好，在我客户的电脑上也运行得很好，但在他们的客户机器上，他们访问的每个页面都会收到混合内容的提示。
然而，无论他们对问题的回答是“是”还是“否”，他们仍然可以获得该网站的所有功能。
我们不能要求他们禁用警告，因为他们会认为我们的应用程序不安全并且不会使用它。
我已经安装了 Httpwatch，并且加载的资源或 URL 均不安全。 使用 https 调用任何 Flash 对象的代码库： 我已经检查了脚本中是否有任何removechild()函数调用，并且没有一个在带有背景图像的div上调用。 我们在代码库中的任何地方都没有调用 javascript:void 。
我不知道接下来要检查什么。 有没有什么方法可以在不造成太大干扰的情况下找出页面试图加载哪些不安全的对象？ 这必须能够在 IE7 或 8 上运行，因为我们不允许在他们的机器上安装任何东西。
I have a web application which works perfectly fine on my own machines, perfectly fine on my customer's PCs but on their customers machines each page they visit they get a prompt for the Mixed Content coming up.
However it doesn't matter whether they answer yes or no to the question, they still get all of the functionality of the site.
We cannot ask them to disable the warning, since they would then consider our application not secure and not use it.
I've installed Httpwatch and none of the resources or urls being loaded are insecure.
The codebase for any flash objects is called using https:
I've checked for any removechild() function calls in the scripts and none of them are called on divs with a background image.
We have no calls to javascript:void anywhere in the codebase.
I'm at a loss as to what to check next.
Is there any way without being too intrusive, to find out what insecure objects the page is trying to load?
This has to be something that will work on IE7 or 8 as we are not allowed to install anything on their machines.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
这有点不合时宜，但我今天遇到了这个问题，并认为我应该参与进来。在 IE9 开发人员工具栏 (F12) 中，控制台选项卡将为您提供导致安全警告的任何项目的列表。安全页面。
This is a bit untimely, but I was running into this issue today, and thought I'd chip in. In the IE9 developer toolbar (F12), the console tab will give you a list of any items which cause a security warning on a secure page.
除了 Dean 的建议之外，为什么不尝试安装 firebug (Firefox) 并查看页面请求的所有内容？
Other than what Dean has suggested, Why not try installing firebug (Firefox) and see everything that the page requests?
除了 IFRAME 之外，还可以是前面提到的 CSS。判断情况是否如此的最佳方法（我就是这样做的）是使用“禁用”>“IE8 开发人员工具”(F12)。 CSS 并查看是否出现问题。如果是，则不在 CSS 中。如果没有，则在 CSS 中。 （在我的例子中，我在background-image标签中有一个硬编码的URL，使用http://。修复方法是使图像相对。）
In addition to the IFRAME, it could be as mentioned CSS. The best way to tell if that's the case -- and I did so -- was to use the IE8 Developer Tools (F12) under Disable > CSS and see if the problem occurs. If yes, not in CSS. If no, in CSS. (In my case, I had a hard-coded URL in background-image tag that used http://. The fix was to make the image relative.)
你有 # 的链接吗？
也就是说，我的情况
正是您所描述的。
编辑任何没有 src 的 iframe，或者带有 IE 不喜欢的 src 的 iframe，都会导致此错误。此外，编辑 CSS 以包含图像并使用相对 URL 也可能会导致此问题，因此带有向下箭头图像的动态下拉菜单也可能会导致该问题。
如果您有权访问该页面，请尝试一次删除其中的一部分，并查看错误是否仍然发生，以追踪该错误可能发生在页面上的位置。 iframe 和 CSS 将是我最看重的两个选择。
Do you have any links to #?
That is, I had an
That caused exactly what you were describing.
Editing, any iframe without a src, or with a src that IE doesn't love, will cause this bug. Also, there's potential that editing CSS to include images and using a relative URL may also cause this one, so dynamic drop down menus with a image of a down arrow on them might also cause the problem.
If you have access to the page, try removing chunks of it at a time, and see if the error still occurs to track down where on the page it might be happening. iframes and then CSS would be my top two bets.
最近我遇到了类似的问题（旧版 IE 浏览器上出现混合内容警告，但专门设计的工具没有发现不安全内容）。
事实证明，这是由 指定的 http url 引起的用于嵌入 Flash 动画的 object 元素的 >codebase 属性。
Recently I had a similar problem (mixed content warning on older IE browsers but no insecure content found by specifically designed tools).
Turns out it was caused by the http url specified at codebase attribute for the object element that was used to embed a Flash animation.
我遇到了类似的问题，结果是 CSS import 语句拉入了其中包含绝对路径元素的子表。就我而言，子表已过时，因此我只是从主 stylesheep 中删除了导入语句。
I had a similar issue, it turned out to be CSS import statements pulling in sub-sheets which had absolute path elements in them. In my case the sub-sheets were obsolete so I simply deleted the import statements from the main stylesheep.