New Posts New Posts RSS Feed: Mixed http/https content
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Mixed http/https content
 Post Reply Post Reply
Author
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
gregweb View Drop Down
DevForce MVP
DevForce MVP
Avatar

Joined: 10-Sep-2009
Location: Clearwater, Fl
Posts: 253 		Post Options Post Options   Quote gregweb Quote  Post ReplyReply Direct Link To This Post Topic: Mixed http/https content
    Posted: 11-May-2011 at 7:25am
I have an app which uses the C1 RichTextBox to display HTML. When there is an external image, it fetches it just fine.
However, in order to secure the data, I switched over to using https. This works great as far as the data is concerned. However, the image fetch for external images then no longer works.
My first thought on this was to check the IE settings for Mixed Content, but this is already enabled.
So am trying to resolve how to allow mixed content.
Any suggestions? Maybe a way of encrypting the data without using https?
Greg
Back to Top
robertg View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 15-Mar-2011
Location: California
Posts: 87 		Post Options Post Options   Quote robertg Quote  Post ReplyReply Direct Link To This Post Posted: 11-May-2011 at 1:40pm
Greg,
 
What are you using to retrieve the images, and where are you retrieving them from? Are you getting them from the same server that' doing the server-side of your application, or is it a different one? Have you considered converting the images to ByteArray, storing them in your database, and then accessing them as entities which you can convert back to images for display?
 
Yours,
Robert
Back to Top
gregweb View Drop Down
DevForce MVP
DevForce MVP
Avatar

Joined: 10-Sep-2009
Location: Clearwater, Fl
Posts: 253 		Post Options Post Options   Quote gregweb Quote  Post ReplyReply Direct Link To This Post Posted: 11-May-2011 at 1:54pm
Hi Robert,
 
The html that is being displayed is an HTML Email.  So, for example, I have my Gmail account hooked up to SecuraEmail.com which is the SL app.
 
So when I open up an email, there are often links to external images.  If I get an html email from RedBox, it is going to have images which need to be downloaded from the RedBox site.  These download just fine if I am not running over https.  But to encrypt the DevForce data that goes across the wire, I use https.  But using the https then prevents the images from downloading.
 
If it is an embedded image in the email, it is a different story as I do convert the image to a ByteArray and then download it via DevForce and it displays just fine.  But I have no control over linked html content that comes in via an email.
 
That is why I was wondering if there was a way to encrypt the DevForce data without having to use https.
 
Greg
Back to Top
robertg View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 15-Mar-2011
Location: California
Posts: 87 		Post Options Post Options   Quote robertg Quote  Post ReplyReply Direct Link To This Post Posted: 12-May-2011 at 10:59am
Oh, that makes perfect sense. I can only come up with a couple of ideas offhand, and they don't seem perfect. These are:

* You could encrypt your data before transmission from your server to the client, and decrypt it in the client for display. Back when I used to be in the ISP business, we would discuss this as encrypting the payload, rather than the transmission. The advantage of this is that you then don't have to use HTTPS to secure your data, and thus can add in sources from other locations which are insecure. The disadvantages are that data encryption requires a lot more system resources than channel encryption, and that you would become responsible for your own security, rather than relying on a standard.

* Rather than retrieving third-party data directly, you could run a proxy on your server which retrieves them, and then serves them across HTTPS to your client. I'm sure you can see the drawbacks of this right away too: increased bandwidth utilization, the false impression that served resources are "from" your server, increased exposure of your server to potential attacks.

I'm really surprised that setting your web client permissions to allow both secure and insecure components within a single page isn't being respected by Silverlight. What mechanism are you using to retrieve these images? I wonder if that mechanism is automatically trying to retrieve them via SSL because the main page transmission was in SSL. Could you debug the app, and see if the URI for these images is different, depending on whether you are using SSL or not?
Back to Top
gregweb View Drop Down
DevForce MVP
DevForce MVP
Avatar

Joined: 10-Sep-2009
Location: Clearwater, Fl
Posts: 253 		Post Options Post Options   Quote gregweb Quote  Post ReplyReply Direct Link To This Post Posted: 12-May-2011 at 7:28pm
Thanks very much Robert, you helped me resolve this issue.
 
Greg
Back to Top
robertg View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 15-Mar-2011
Location: California
Posts: 87 		Post Options Post Options   Quote robertg Quote  Post ReplyReply Direct Link To This Post Posted: 16-May-2011 at 2:13pm
Greg,
 
I'm glad to hear that! Do you mind sharing what the problem was, in case we see any other developers hit the same snag?
 
-- Robert
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down