Skip to content

Mixed content: browser requests HTTPS images from onion domain accessed via HTTP

Latest alpha version: 14.0a1 (based on Mozilla Firefox 128.0esr), Standard security level.

Onion web-site is HTTP (does not have HTTPS version for it's complicated and expensive). I believe most onion web-sites are HTTP. It now stopped loading images and other static resources from onion domain, because upgrades all static requests to HTTPS. Example: Requesting http://abcabcabcabc.onion Document has links (stylesheets / scripts) from CDNs with //cdn.. links (scheme-less). It also has images from the same server (domain), requested like /img/abc.jpg

Images don't load and Console is full of such messages: Mixed Content: Upgrading insecure display request ‘http://abcabcabc.onion/img/logo.png’ to use ‘https’

It wasn't like this in any previous version and I see little ways of overcoming it, except for:

  • not using CDNs
  • moving all images to another server (insecure and complicated in maintaining)
  • obtaining SSL certificate, which is again complicated and unacceptable for most web-sites.

Is such behavior planned to stay this way in oncoming official versions or is it a bug that will be fixed? If it's gonna stay, what do you suggest to make web-sites work again?

Thank you very much.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information