nfl / jquery-oembed-all

A fork with improvements of the jquery-oembed project
141 stars 57 forks source link

Mixed Content warning for HTTPS YouTube links in HTTPS parent page #26

Closed AniX closed 9 years ago

AniX commented 9 years ago

If the parent page is loaded via HTTPS, YouTube links will not be shown due to a Mixed Content warning, even if they are HTTPS links. An HTTPS Twitter links works in the same setup.

Parent page

https://www.mydomain.com/example.html FICTIVE URL!

<html>
  <!-- other stuff -->
  <body>
    <a class="oembed" href="https://www.youtube.com/watch?v=iQnWuIGq2CM">https://www.youtube.com/watch?v=iQnWuIGq2CM</a>
  </body>
</html>

Binding

$('a.oembed').oembed()

(no custom settings)

JavaScript console

Mixed Content: The page at 'https://www.mydomain.com/example.html' was loaded over HTTPS, but requested an insecure resource 'http://www.youtube.com/embed/iQnWuIGq2CM?wmode=transparent&jqoemcache=N1doi'. This request has been blocked; the content must be served over HTTPS.

It seems a redirect is triggered to an HTTP address, maybe on YouTube's part?

Using the exactly same setup but with an HTTPS Twitter link, e.g. https://twitter.com/reinmarpl/status/573118615274315776 works as expected, i.e. no Mixed Content warning.

Interestingly, I can find a few requests to twitter.com, but no requests to youtube.com.

The problem occurs with Chrome and Firefox.

I can provide additional data if needed.

AniX commented 9 years ago

Regarding a wordpress ticket with mixed content warnings a user suggests the following (quote):

YouTube's oEmbed doesn't do protocol relative URLs. You have to explicitly tell it the scheme to use, with scheme=https for it to use https links in the returned HTML from their embed endpoint.

Maybe that's the reason?