Deezer content is served over HTTP

问题:

I am using Deezer Javascript SDK and loaded it over https.

<script src="https://cdns-files.deezer.com/js/min/dz.js"></script>

But from today Chrome and Firefox has problem, because Deezer SDK loading some script over https and Chrome rejected as insecure content.

Chrome console:

Mixed Content: The page at 'https://....' was loaded over HTTPS, but requested an insecure script 'http://www.deezer.com/js_trad-v00340851.php?l=cs'. This request has been blocked; the content must be served over HTTPS. playerBB.php:1 Mixed Content: The page at 'https://....' was loaded over HTTPS, but requested an insecure script 'http://cdn-files.deezer.com/js/min/core-v00340851.js'. This request has been blocked; the content must be served over HTTPS. playerBB.php:1 Mixed Content: The page at '...' was loaded over HTTPS, but requested an insecure script 'http://cdn-files.deezer.com/js/min/live-v00340851.js'. This request has been blocked; the content must be served over HTTPS.

回答1:

This happens when your page and remote resource are using different HTTP protocols: one uses HTTP and another uses HTTPS.

The preferred way to include third-party scripts is this one:

<script src="//cdns-files.deezer.com/js/min/dz.js"></script>

Removing https: or http: tells browser to load the document using same protocol as current page. This should eliminate security warnings.

回答2:

when i set the url : <a href="http://127.0.0.1:8080/download/1.txt"></a> from a https request, it report error : Mixed Content: The page at 'https://127.0.0.1/index.html' was loaded over HTTPS, but requested an insecure resource 'http://127.0.0.1:8080/download/1.txt'. This request has been blocked; the content must be served over HTTPS. Failed to load resource: net::ERR_CACHE_MISS

when i added the target="_blank" to the url: <a target="_blank" href="http://127.0.0.1:8080/download/1.txt">, it works! , it works! it's well known that target="_blank" means opening the linked document in a new window or tab or a new request!