DevForce 2010: Mixed http/https content

Print Page | Close Window

Mixed http/https content

Printed From: IdeaBlade
Category: DevForce
Forum Name: DevForce 2010
Forum Discription: For .NET 4.0
URL: http://www.ideablade.com/forum/forum_posts.asp?TID=2666
Printed Date: 29-Jul-2026 at 8:30pm

Topic: Mixed http/https content

Posted By: gregweb
Subject: Mixed http/https content
Date Posted: 11-May-2011 at 7:25am

I have an app which uses the C1 RichTextBox to display HTML. When there is an external image, it fetches it just fine.

However, in order to secure the data, I switched over to using https. This works great as far as the data is concerned. However, the image fetch for external images then no longer works.

My first thought on this was to check the IE settings for Mixed Content, but this is already enabled.

So am trying to resolve how to allow mixed content.

Any suggestions? Maybe a way of encrypting the data without using https?

Greg

Replies:

Posted By: robertg
Date Posted: 11-May-2011 at 1:40pm

Greg,

What are you using to retrieve the images, and where are you retrieving them from? Are you getting them from the same server that' doing the server-side of your application, or is it a different one? Have you considered converting the images to ByteArray, storing them in your database, and then accessing them as entities which you can convert back to images for display?

Yours,

Robert

Posted By: gregweb
Date Posted: 11-May-2011 at 1:54pm

Hi Robert,

The html that is being displayed is an HTML Email. So, for example, I have my Gmail account hooked up to SecuraEmail.com which is the SL app.

So when I open up an email, there are often links to external images. If I get an html email from RedBox, it is going to have images which need to be downloaded from the RedBox site. These download just fine if I am not running over https. But to encrypt the DevForce data that goes across the wire, I use https. But using the https then prevents the images from downloading.

If it is an embedded image in the email, it is a different story as I do convert the image to a ByteArray and then download it via DevForce and it displays just fine. But I have no control over linked html content that comes in via an email.

That is why I was wondering if there was a way to encrypt the DevForce data without having to use https.

Greg

Posted By: robertg
Date Posted: 12-May-2011 at 10:59am

Oh, that makes perfect sense. I can only come up with a couple of ideas offhand, and they don't seem perfect. These are:

* You could encrypt your data before transmission from your server to the client, and decrypt it in the client for display. Back when I used to be in the ISP business, we would discuss this as encrypting the payload, rather than the transmission. The advantage of this is that you then don't have to use HTTPS to secure your data, and thus can add in sources from other locations which are insecure. The disadvantages are that data encryption requires a lot more system resources than channel encryption, and that you would become responsible for your own security, rather than relying on a standard.

* Rather than retrieving third-party data directly, you could run a proxy on your server which retrieves them, and then serves them across HTTPS to your client. I'm sure you can see the drawbacks of this right away too: increased bandwidth utilization, the false impression that served resources are "from" your server, increased exposure of your server to potential attacks.

I'm really surprised that setting your web client permissions to allow both secure and insecure components within a single page isn't being respected by Silverlight. What mechanism are you using to retrieve these images? I wonder if that mechanism is automatically trying to retrieve them via SSL because the main page transmission was in SSL. Could you debug the app, and see if the URI for these images is different, depending on whether you are using SSL or not?

Posted By: gregweb
Date Posted: 12-May-2011 at 7:28pm

Thanks very much Robert, you helped me resolve this issue.

Greg

Posted By: robertg
Date Posted: 16-May-2011 at 2:13pm

Greg,

I'm glad to hear that! Do you mind sharing what the problem was, in case we see any other developers hit the same snag?

-- Robert

Print Page | Close Window