[IE7 and HTTPS] IE7 throws a Security Information: This page contains both secure and nonsecure items

[Paul Christopher]

Description

Running the attached test case in IE8 with IE7 mode enabled gives a warning dialog box:

"Security Information: This page contains both secure and nonsecure items"

Please note: This behaviour is not reproducible on IE9 with IE7 mode enabled, but IE7 only or IE8 in IE7 mode.

The strange thing is: The test page contains just a simple dijit/form/ValidationTextBox and and dijit/form/Button. So I have no idea why IE7 thinks, there are nonsecure items...

Steps to reproduce the issue

Deploy the test file on your server. Run it with ​https://... and not ​http://. In IE7, this triggers a warning message as described above.

Discussion

Does the new AMD loader cause the trouble? Or am I just making a stupid mistake? Sorry for the imprecise ticket this time...

[bill]

See also #8373 and #6603. Not sure if it's worth fixing this though; we dropped IE7 from our list of supported browsers.

[Paul Christopher]

Our customer still uses IE7, and I thought that IE7 is still supported in Dojo 1.x. I personally have now idea how to debug this issue. Could you give me a hint how to spot the neuralic point?

The problem is, that I only get a warning message but no hint, what actually is considered as nonsecure by the browser.

The tickets you have mentioned above are closed as "fixed" (whereas one of the tickets is a duplicate of the other ticket).

Apparently, something else seems to cause the trouble now...

[bill]

These problems are always tricky, and seem to be random. It could be an <img> node that it tries to load, accessing blank.gif and not liking the path to it. We went through pains to get that to work without errors but it seems to be different for every person.

[Paul Christopher]

Bill, thank you very much for that hint!

Indeed it was the img url. I could fix it by adjusting the config.blankGif and config.blankHtmlUrl.

Puhh, happy that I could resolve that issue...

[bill]

OK good. Was something weird about the image URL? Isn't it just a relative path without ​http:// or anything like that?

[Paul Christopher]

I have just specified a fully qualified path for blank.gif and blank.html with the above mentioned config parameters. And this did the trick, luckily.

E.g.

<script src="js/dojo/dojo.js" data-dojo-config="async:true, parseOnLoad:true, blankGif:'https://myserver/dojo/resources/blank.gif', blankHtmlUrl:'https://myserver/dojo/resources/blank.html' "></script>

[bill]

OK. My memory is that we are using (what I consider) a perfectly reasonable URL like "../dojo/resources/blank.gif" or "/dojo/resources/blank.gif" or javascript:"", and it still complains for some people, so I think that's the only workaround. Glad it's working for you.