IE6: "Secure and nonsecure items" with Content Advisor, SSL, IFRAMEs

[Jonathan Hoersch]

Hello,

We have come across what appears to be a bug in Internet Explorer 6,
and it is becoming an issue for our customers. Here is the situation:

- Our web servers are running IIS 5.0 on Windows 2000. (I have also
tested with IIS 5.1 on Windows XP; same problem)
- We use ASP to generate our web pages.
- Connections to the site are through SSL.
- Each web page has an IFRAME in it. The SRC of the IFRAME is
*always* set to something. The problem persists regardless of the
form of the SRC; e.g., each of the following:
- SRC="dummy.html"
- SRC="./dummy.html"
- SRC="https://localhost/mysite/dummy.html"
- The browser is IE 6 SP1 on Windows XP, with all the latest patches.
The problem may exist in other versions/platforms.
- The web browser has Content Advisor turned ON.
- The problem persists whether the server returns content ratings or
not.

The problem is that, navigating to every new page in the site produces
the message "This page contains both secure and nonsecure items. Do
you want to display the secure items?" The error comes precisely when
the IFRAME is being loaded. Whether or not I click Yes or No, the
IFRAME is still displayed in its entirety.

All referenced resources come via HTTPS, so I know that the problem is
not that there is actually mixed content. The real issue is, this
message is only displayed when Content Advisor is turned on in IE.
Otherwise, everything is fine.

Has anyone else encountered this bug and a potential solution or
workaround? Telling our customers to tell their users to turn off
Content Advisor is not a good long term solution.

Thanks in advance,
Jonathan Hoersch

 

[Sagi Sefer]

Hi Jonathan
It seems that we facing the same problems. Have you manage to solve
this problem ?.

 

[Robert Aldwinckle]

....

Hi Jonathan
It seems that we facing the same problems. Have you manage to solve
this problem ?.

Why can't you make Content Advisor aware of this element too?


---

 

[cseps]

Solution: In the Security tab in options, if you go to ‘custom level
for the Internet zone (not the trusted zone, as you might think), ther
is a setting for ‘Display Mixed Content.’ By default it is set t
prompt. Setting this to enable will get rid of the popup. What mad
this tricky for is that we were trying to set this for users on
locked down machine. This required going into HKEY_USERS\{user’
entry}\Software\Microsoft\Windows\CurrentVersion\InternetSettings\Interne
Zones\3 and changing the corresponding registry key (1609) to 0, whic
is enable


-
csep