Sitecore Mixed Content error for workflow

Question

I am running into issue while using worflow in the site over HTTPS. When Item is either approved or rejected basically page refreshes and in the console i get error like

Mixed Content: The page at 'https://site/sitecore/shell/default.aspx?sc_lang=en' was loaded over HTTPS, but requested an insecure resource 'http://site//sitecore/shell/default.aspx?xmlcontrol=Workbox&mo=preview&reload=1&{190B1C84-F1BE-47ED-AA41-F42193D9C8FC}=0&{46DA5376-10DC-4B66-B464-AFDAA29DE84F}=0&{FCA998C5-0CC3-4F91-94D8-0A4E6CAECE88}=0'. This request has been blocked; the content must be served over HTTPS.

By the way we are using Sitecore.NET 8.1 (rev. 160519)

I found same issue at with no answers.

Answer 1

In my case we have a load balancer terminating TLS and then passing decrypted traffic to the backend CM server on port 80.

The only solution we could get working is to add a the header Content-Security-Policy to the Web.config with a value of upgrade-insecure-requests.

Now Chrome does not block the execution of the link but rather upgrade to https.

Example: The following transform could be used in your project.

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-Powered-By" />
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-Frame-Options" value="SAMEORIGIN"/>
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-XSS-Protection" value="1; mode=block"/>
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="X-Content-Type-Options" value="nosniff"/>
        <add xdt:Transform="InsertIfMissing" xdt:Locator="Match(name)" name="Content-Security-Policy" value="upgrade-insecure-requests"/>
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

Answer 2

To stop your site from serving mixed content, you will need to ensure that HTTPS is used for all pages. How exactly you achieve this is up to you; there are several existing approaches that you can apply separately or together:

1. Add scheme="https" to all site definitions.
2. You may need to add port="443" to your site definitions as well, but then you'll probably want to remove the port 443 from Sitecore-generated URLs.
3. Create a custom HttpRequestProcessor that will redirect all HTTP requests to use HTTPS.
4. Use the IIS URL Rewrite module to achieve the same goal. There are many articles on the web that show how you can do this specifically to rewrite HTTP to HTTPS—e.g. 1, 2, 3, 4.