11

I am running into issue while using worflow in the site over HTTPS. When Item is either approved or rejected basically page refreshes and in the console i get error like

Mixed Content: The page at 'https://site/sitecore/shell/default.aspx?sc_lang=en' was loaded over HTTPS, but requested an insecure resource 'http://site//sitecore/shell/default.aspx?xmlcontrol=Workbox&mo=preview&reload=1&{190B1C84-F1BE-47ED-AA41-F42193D9C8FC}=0&{46DA5376-10DC-4B66-B464-AFDAA29DE84F}=0&{FCA998C5-0CC3-4F91-94D8-0A4E6CAECE88}=0'. This request has been blocked; the content must be served over HTTPS.

By the way we are using Sitecore.NET 8.1 (rev. 160519)

I found same issue at with no answers.

Improve this question
4
  • 1
    What is the port specified on shell website? Try to ensure its 443. <site name="shell" port="443" virtualFolder="/sitecore/shell" physicalFolder="/sitecore/shell" rootPath="/sitecore/content" startItem="/home" language="en" database="core" domain="sitecore" loginPage="/sitecore/login" content="master" contentStartItem="/Home" enableWorkflow="true" enableAnalytics="false" analyticsDefinitions="content" xmlControlPage="/sitecore/shell/default.aspx" browserTitle="Sitecore" htmlCacheSize="2MB" registryCacheSize="3MB" viewStateCacheSize="200KB" xslCacheSize="5MB"/>
    – xoail
    Nov 16 '16 at 17:16
  • @xoail Yes i tried putting port="443" but it just broke my site. It won't allow me to sitecore login. Also tried adding scheme="htttps" but that too did not helped.
    – Jaydeep
    Nov 16 '16 at 17:48
  • @Jaydeep Have you been able to resolve the issue? If the advice from my answer hasn't worked for you, consider editing your question to include more detail about the current state of your problem.
    – Dmytro Shevchenko
    Dec 15 '16 at 14:24
  • I am having exact same issue. Any solution for this?
    – shiva
    Feb 23 '18 at 5:44
5

In my case we have a load balancer terminating TLS and then passing decrypted traffic to the backend CM server on port 80.

The only solution we could get working is to add a the header Content-Security-Policy to the Web.config with a value of upgrade-insecure-requests.

Now Chrome does not block the execution of the link but rather upgrade to https.

Example: The following transform could be used in your project.

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-Powered-By" />
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-Frame-Options" value="SAMEORIGIN"/>
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-XSS-Protection" value="1; mode=block"/>
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-Content-Type-Options" value="nosniff"/>
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="Content-Security-Policy" value="upgrade-insecure-requests"/>
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>
Improve this answer
4

To stop your site from serving mixed content, you will need to ensure that HTTPS is used for all pages. How exactly you achieve this is up to you; there are several existing approaches that you can apply separately or together:

  1. Add scheme="https" to all site definitions.
  2. You may need to add port="443" to your site definitions as well, but then you'll probably want to remove the port 443 from Sitecore-generated URLs.
  3. Create a custom HttpRequestProcessor that will redirect all HTTP requests to use HTTPS.
  4. Use the IIS URL Rewrite module to achieve the same goal. There are many articles on the web that show how you can do this specifically to rewrite HTTP to HTTPS—e.g. 1, 2, 3, 4.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.