Hacker News new | ask | show | jobs
by AgentME 2247 days ago
>Since Chrome v80 they forced <video> <img> content to switch to HTTPS, if the page itself is served https. Is it really a good idea? So for Intranet URLs with customize TLDs, you have exactly three choices

If the intranet isn't set up to be able to serve over HTTPS, then wouldn't the intranet page be served over HTTP too and not make this an issue? Is it really common to have intranet sites where you have some of the endpoints covered by HTTPS and some not, and further, the HTTPS intranet page embedding content from intranet HTTP sites?
1 comments
est 2247 days ago
> then wouldn't the intranet page be served over HTTP too and not make this an issue?

The page itself is served in both HTTP and HTTPS, can be visited in and outside the LAN.

The <img> and <video> content fail in HTTPS without explanation in Chrome v81+

link
Dylan16807 2247 days ago
> The page itself is served in both HTTP and HTTPS, can be visited in and outside the LAN.

So why can't you use one of these options:

1. Redirect all users to HTTPS, since you apparently already have a globally valid certificate.

2. Rewrite the tags to use HTTPS only when the page is loaded over HTTPS.

3. Set upgrade-insecure-requests only when the page is loaded over HTTPS.

link
est 2247 days ago
Because the <img> <video> content is served on a LAN machine with custom TLD. HTTPS don't work with that.

However I can use reverse of your methods to redirect every HTTPS to HTTP.

link
Dylan16807 2247 days ago
When you say "the page itself" can be visited outside the LAN, does that include the images and videos? If it doesn't, what's the use case?

Inside the LAN, when you visit the page over HTTPS the URL bar has a globally valid domain, right? So why do you even want the LAN machine to have a custom TLD, if that's going to be invisible to the user?

link
est 2247 days ago
> does that include the images and videos? If it doesn't, what's the use case?

Certain pages of have media content that can only be viewed in LAN. However since the the HTTPS page is used in and outside lan, users tend to keep visiting the site with HTTPS enabled. After Chrome upgraded to v81, the images and videos failed to load. And there is little site admin can do to quickly restore the access.

link