在安全页面上使用第 3 方 RSS 源可能会遇到哪些安全问题
我有一个基于 https 的页面。这上面有一个iframe，iframe的域与top相同。
此 iframe 使用 google feed reader (gfdynamicfeedcontrol）从第 3 方网站读取 RSS 提要。
此设置可能会遇到哪些安全问题，是否有更好的方法来做到这一点？ 谢谢
I have a page over https. This has an iframe on it, and the domain of the iframe is the same as top.
This iframe uses google feed reader (gfdynamicfeedcontrol) to read rss feeds from 3rd party sites.
What security issues can I run into with this setup, and is there a better way to do this?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
只要它是静态内容，例如图像或计算脚本，就可能没问题。问题是有人可能会加载本来应该通过 SSL 保护的内容。这意味着当浏览器注意到页面上同时包含安全和不安全内容时，浏览器会感到恐慌，并向用户发出警告。这可能会吓跑用户离开您的网站。
如果您采用此设置，您将在各处看到浏览器警告。
As long as it's static content such as just images or a calculation script it's probably fine. The problem is that someone may load content which really should have been secured via SSL. This means that the browser freaks out when it notices pages which have both secure and unsecure content on them and will warn users. This can scare users away from your site potentially.
You're going to have browser warnings everywhere if you go with this setup.