如何准确判断哪些不安全项目导致浏览器对混合安全和不安全项目发出警告？
在 Firefox 中，我查看我的网站，但没有收到有关不安全混合内容的警告。
使用 FireBug，我可以看到每个请求都是 https。
在 Chrome 中，我在地址栏中将 https 划掉了。
我在 Chrome 中查看了源代码，然后运行了这个正则表达式 /http(?!s)/ 但它发现的唯一内容是一些外部链接的 href 属性和文档类型和 http-equiv 元标记。
使用 Chrome 的资源跟踪显示所有请求也都是 https。
这包括 Google Analytics、来自 Google CDN 的 jQuery 和 Facebook 之类的脚本。
是否有任何特定工具可以用来显示非 https 请求，或者我可以进一步尝试什么？
In Firefox, I view my site and get no warnings about insecure mixed content.
Using FireBug, I can see that every request is https.
In Chrome, I get the https crossed out in the address bar.
I viewed source in Chrome and then ran this regex /http(?!s)/ but the only things it found were the href attributes for some external links and the doc type and http-equiv meta tags.
Using Chrome's Resource Tracking revealed all requests were https too.
This includes Google Analytics, jQuery from Google's CDN and Facebook like scripts.
Is there any specific tool I can use to show non https requests, or anything further I can try?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
我发现，即使在没有混合内容的情况下，如果在会话期间域中已经遇到混合内容，我也会在 Chrome 中收到“混合内容”警告。
（这里还提到：为什么 Chrome 会报告安全/不安全警告，而其他浏览器却没有报告安全/不安全警告？）
I found that I get the "mixed content"-warning in Chrome even when there is no mixed content, if sometime during the session mixed content was already encountered on the domain.
(Also mentioned here: Why is Chrome reporting a secure / non secure warning when no other browsers aren't?)
在 Chrome 的开发者工具中，“控制台”选项卡显示不会加载的资源，因为它们不安全。
In Chrome's Developer Tools, the Console tab shows the resources that it won't load because they unsecure.
您可以将“方案”列添加到 Chrome 开发人员工具网络选项卡，以显示通过 http 或 https 发送的请求：
You can add the "scheme" column to the Chrome developer tools network tab to show which requests were sent over http or https:
在 Chrome 的 48 版本中，他们添加了 安全面板。使用它您可以快速识别混合内容资源：
In 48-th version of chrome they added a security panel. Using it you can quickly identify the mixed content resources:
在这种情况下，准确查看使用哪个协议来加载资源很有帮助，我建议使用 Fiddler2 作为与浏览器无关的解决方案，可以准确地向您显示每个请求上发生的流量。
从网站：
编辑：浏览器内调试工具变得非常好，因此这个第三方工具可能不如第一次编写此答案时那么有用。
In situations like this where it's helpful to see exactly which protocol is being used to load resources, I would recommend Fiddler2 as a browser-agnostic solution that can show you exactly what traffic is occurring on each request.
From the site:
Edit: In-browser debugging tools are becoming really good so this third-party tool may not be as useful as it was when this answer was first written.
打开 Web 检查器并找到右上角的黄色三角形（警告）。单击它，它将显示所有安全问题。
Open up the Web Inspector and find the yellow triangle (warning) in the top right. Click on it and it will display all security issues.
你有 FireFox 的 HttpFox 插件吗？我认为那会起作用。
除此之外，它还报告网页请求的所有资产的 URL、方法、结果代码和字节。这是我用来捕获偶尔的非 HTTPS 图形等的方法。我确信其他建议的工具也会做同样的事情......
Do you have the HttpFox plugin for FireFox? That'd work, I think.
Among other things, it reports on the URL, Method, Result Code, and bytes of all the assets that a web page requests. It's what I've used to trap the occasional non-HTTPS graphic, etc. I'm sure the other suggested tools would do the same...
您可以使用 SslCheck
这是一个免费的在线工具，可以递归地抓取网站（跟踪所有内部链接）并扫描不安全的内容包括 - 图像、脚本和 CSS。
（免责声明：我是开发者之一）
You can use SslCheck
It's a free online tool that crawls a website recursively (following all internal links) and scans for nonsecure includes - images, scripts and CSS.
(disclaimer: I'm one of the developers)
我知道这篇文章很旧，但我遇到了它并遇到了同样的问题。我点击了 Chrome 菜单（右上角），向下滚动到“工具”>“并选择开发人员工具。单击“控制台”选项卡，它准确地告诉我问题是什么...图标是通过 http 而不是 https 提供的，但当然它不在页面源代码中。更正了我的 CMS 中的问题，该问题加载了页面中没有代码的图标...并且不再出现错误！
I know this post is old, but I ran across it and had the same issue. I clicked on the Chrome menu (top right corner), scrolled down to Tools> and selected Developer Tools. Clicked on the Console tab and it told me exactly what the problem was... the favicon was served over http, not https, but of course it was not in the page source code. Corrected the problem in my CMS, which loads the favicon without code in the page... and no more error!
请注意，“混合内容”和“混合脚本”是单独检测的。检查此网站以了解 Chrome 中图标的含义：https:// /support.google.com/chromebook/answer/95617?p=ui_security_indicator&rd=1（点击“查看详细信息”链接）。
灰色图标 = 混合内容，红色图标 = 混合脚本。
Note that 'mixed content' and 'mixed scripting' are detected seperatly. Check this site for the meaning of the icons in Chrome: https://support.google.com/chromebook/answer/95617?p=ui_security_indicator&rd=1 (click 'see details' link).
Grey icon = mixed content, red icon = mixed scripting.