How can I get around this? I wan't to make sure my users see the content without having to press the "disable protection on this page" button.
问题:
回答1:
What you're trying to do is load Youtube over an http
connection whilst your own site is served over a https
connection, thus making it possible for a man in the middle attack to change the content of youtube and thus affect your site. As youtube doesn't allow loading the videos over https
as far as I can see there is no way to really solve this problem if your site needs to really work over https
. Either you will have to disable the secured connection on your site or alternatively not use Youtube, whatever you choose you will have to accept that the loaded page will be insecure.
(Btw, I am not sure how the browser treats mixed content, because loading the youtube player is possible over https
, however loading the video stream over https
is not possible, so I pressume that with the HTML5 player it won't work and with the flash player it will work, but I would have to do more testing to make sure of this)