Agent WranglersAPS-24Recommended
Load nothing over plain HTTP
Load every file over HTTPS. Add upgrade-insecure-requests as a safety net.
How to do it
Use root-relative or https:// addresses for every file. Add upgrade-insecure-requests to the CSP on HTTPS. The Encrypt data on the wire and on disk rule covers connections between your own servers.
Examples
HTML example
<!-- Good: root-relative or https -->
<img src="/logo.svg" alt="Example">
<script src="https://cdn.example.com/app.js"></script>
<!-- Bad: plain http on an https page -->
<img src="http://example.com/logo.svg" alt="Example">How to check
grep -rnE '(src|href|action|srcset)="http://' dist/ finds nothing in the built pages. The browser console shows no mixed-content warnings.
Sources
Related rules
- APS-54 Encrypt data on the wire and on disk in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/mixed-content">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.