Mixed content: browser requests HTTPS images from onion domain accessed via HTTP
Latest alpha version: 14.0a1 (based on Mozilla Firefox 128.0esr), Standard security level.
Onion web-site is HTTP (does not have HTTPS version for it's complicated and expensive). I believe most onion web-sites are HTTP. It now stopped loading images and other static resources from onion domain, because upgrades all static requests to HTTPS. Example: Requesting http://abcabcabcabc.onion Document has links (stylesheets / scripts) from CDNs with //cdn.. links (scheme-less). It also has images from the same server (domain), requested like /img/abc.jpg
Images don't load and Console is full of such messages: Mixed Content: Upgrading insecure display request ‘http://abcabcabc.onion/img/logo.png’ to use ‘https’
It wasn't like this in any previous version and I see little ways of overcoming it, except for:
- not using CDNs
- moving all images to another server (insecure and complicated in maintaining)
- obtaining SSL certificate, which is again complicated and unacceptable for most web-sites.
Is such behavior planned to stay this way in oncoming official versions or is it a bug that will be fixed? If it's gonna stay, what do you suggest to make web-sites work again?
Thank you very much.