InformAction Forums

NoScript has a feature in its advanced section to force certain domains to always go over HTTPS.
Firefox 23+ has a feature to block mixed content (plaintext requests from HTTPS origin).

Problem no. 1: even if I use NoScript's HTTPS forcing feature, Firefox won't show the padlock and still complains about mixed content.
Problem no. 2: if I turn on the mixed content blocker, it runs first and blocks everything before NoScript gets a chance to do its rewriting.

Any thoughts on how to proceed to make these work? Ideally I'd prefer if Firefox had a built-in force https feature, but since it doesn't, NoScript's is the next best thing, but right now it's interacting with Firefox in this undesirable way.

> no. 1:

URL where this occurs?


Reference: Bug 844556 - [tracking] compatibility issues with mixed content blocker on non-Mozilla websites

Just checking: are all of the resources actually being caught by the Force HTTPS feature? Ie you're definitely catching all of the affected domains?

I have the same problem on https://www.elmoto.net/ : specifically, CSS files show mixed content errors, while js, png, and gif files all seem to be redirected fine. I'm using NoScript 2.6.8.17 with Firefox 27.0.1 (Fedora 20), and I have a HTTPS rule for www.elmoto.net . The Firebug console shows (one line removed because it tripped the forum spam filter):

Blocked loading mixed active content "http://www.elmoto.net/clientscript/vbul ... 1391981016"
Blocked loading mixed active content "http://www.elmoto.net/clientscript/vbul ... 1391981016"
Blocked loading mixed active content "http://www.elmoto.net/clientscript/vbul ... 1391981016"
Blocked loading mixed active content "http://www.elmoto.net/clientscript/vbul ... 1391981016"
Blocked loading mixed active content "http://www.elmoto.net/clientscript/vbul ... 1391981016"
Blocked loading mixed active content "http://www.elmoto.net/clientscript/vbul ... 1391981016"

Looking for a work around, thanks.

Maybe Firefox should give users the option of either blocking mixed content or forcing it to HTTPS (which will have the same effect if HTTPS is not available, but will fix the problem when it is available).

Anyone know whether there is a bug for this?

EDIT: Bug is here.

Well, there is this bug, which points out that the same issue occurs with "mixed content" that is actually secured by HSTS.