We Keep Coding

HTTP and HTTPS version of a same page render differently

Here are the links to the page in question:
http version
https version
The https version of the page doesn't render the video embedded on the top of the article. I inspected the source code and found that HTTPs is missing an entire block of code, as you can see in the images below:
I wonder how this happens? Isn't http(s) just the protocol to communicate with the server? Why do I get different code by using different protocols?

From Chrome Developer Toolkit:
The page at 'https://www.eyeviewdigital.com/blog/eyeview-launches-addressable-tv-ads-with-cablevision-dish-programmatic-tv-w-clypd-and-wideorbit/' was loaded over HTTPS, but requested an insecure script 'http://pshared.5min.com/Scripts/PlayerSeed.js?sid=281&width=480&height=401&playList=519141523'. This request has been blocked; the content must be served over HTTPS.
You typically need to load your content in either http or https. Mixing them together results in the error above.
On line 252 replace
http://pshared.5min.com/Scripts/PlayerSeed.js?sid=281&width=480&height=401&playList=519141523
with
https://delivery.vidible.tv/aol?sid=281&width=480&height=401&playList=519141523.js
Long story short the content was never loaded so the page looked different.

You're right that there should be no difference based on http/https as it is just the transport layer. There must be something in the server's code that is producing the html, that behaves differently based on the url used to make the request. I suggest you provide information on the web server code to help analyse the issue.

This is most likely caused because you're loading elements from insecure sources. Google Chrome for example, loading an image over http when your page is loaded over https can result in the image not loading at all. This is all for security purposes, of course. Just go through all of your code and make sure all sources are accessed through secure https so that they load in properly.

Load javascript file from other domain in bookmarklet?

I'm quite new to bookmarklets. I'm trying to load a javascript file from my own server/domain by using the following bookmarklet/javascript code:
javascript:(function(){s=document.createElement('script');
s.type='text/javascript';
s.src='http://www.test.com/js.js?v='+parseInt(Math.random()*99999999);
document.body.appendChild(s);})();
This code works nicely (js.js is loaded and executed) when i press the bookmarklet on my firefox toolbar when visiting pages on the test.com domain.
But when i go to google.com or any other sites and press the bookmarklet button the http://www.test.com/js.js isn't even loaded (looking in server log)
I know about cross domain restrictions but don't they apply to ajax request and related things?

This has nothing to do with CORS
You are loading unsafe content (http) in a secure page (https). Mixed content on secure pages don't work. You need to serve your script with https as well

How to fix a drupal (https) website with blocked mixed content

My Drupal e-commerce site is working on https.I want to embed below code to a page.
<iframe src="http://files.podsnack.com/......"(not exact code)
But src is on http, due to this not able to load the iframe in the page. I am getting below error.
Blocked loading mixed active content "http://files.podsnack.com/iframe/embed.html?hash=avcsgijp&t=1402616221"
carouFredSel: No element found for "#clients-scroller".
plugins... > eval (line 1)
Given URL is not allowed by the Application configuration.: One or more of the given URLs is not allowed by the App's settings. It must match the Website URL or Canvas URL, or the domain must be a subdomain of one of the App's domains.
Note: src will not work on https.
Please advise.

I'm afraid you cannot load an iframe via http on a https page securely, thus getting the errors. Browsers are beginning to just completely block this now, where as older browsers would just give a warning.
The only way to get it to load is using https for the iframe, or accessing the page via http instead of https.
See this blog post about Firefox introducing the block: https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/
and here's a page about IE blocking mixed content: http://support.microsoft.com/kb/2625928
and here's a page about Chrome blocking mixed content or warning about it: https://support.google.com/chrome/answer/1342714?hl=en
And see this post for a general explanation of the problem: https://developer.mozilla.org/en-US/docs/Security/MixedContent/How_to_fix_website_with_mixed_content

issue while navigating through https protected sites

I am login into a URL say
<https://test.ur>/hix using https
Now when I am navigating to other page clicking a link Nothing is getting loaded in the chrome browser and I am getting below exception in the chrome browser console
I am getting an issue like
The page at '<<https://test.ur>>/hix/account/signup' was loaded over HTTPS, but ran insecure content from 'http://test.ur/hix/entity/locateassister/locateassistancety…%22%2C%22Yuchi%22%2C%22Yuma%22%2C%22Yupik%22%2C%22Yurok%22%2C%22Zuni%22%5D': this content should also be loaded over HTTPS.
I am using spring in all of my application and using relative URL to navigate.
Also on this portal on whichever page I navigate I get
GET https://themes.googleusercontent.com/static/fonts/robotoslab/v3/y7lebkjgREBJK96VQi37ZobN6UDyHWBl620a-IRfuBk.woff net::ERR_SSL_PROTOCOL_ERROR
in the browser console

When you're on an HTTP page, it's insecure to call HTTP content (to get JS, image or in iFrame).
Some browsers (and some versions) will block these contents. Some others will show you a message to inform you.
Solutions
First: What you can delocate all your HTTP resources into HTTPS (if possible).
Second: If the resources are on the same server as the one who serves the page, you can also load resources with relative path and not with absolute path. Or you can do a protocol relative path. For example, instead of
<img src="https://localhost:8080/img/logo.png" />
You will write
<img src="//localhost:8080/img/logo.png" />

Mixed Content Warning IE: What matters; css, images, everything?

I have just moved my site from http to https and IE-9 started showing non-secure content warning at home page. This warning is understandable because i have one http call to googleapi for getting jquery script. But when I login and enter the inner pages there is no warning from IE despite the fact that most of the images are coming from other servers through http protocol.
So the question: Is getting image over http is fine when accessing site over https? Does only css and js matters? or shall I have to get all the data through HTTPS? If so how is my scenario justifiable (getting images over http from other server on https page without warning)?

If you load CSS and JS over HTTP then an attacker can inject executable code. Unfortunately IE will execute JavaScript within CSS. The problem with loading images over HTTP from the same domain is that the browser will likely spill the session id in plain text which is a violation OWASP a9.

You can use the protocol-relative URL on all your urls to avoid this issue in IE.
Basicaly, instead of linking to a js/image/css by using its full path with the protocol, you instead link to it by leaving out the protocol bit and just using a double slash, //.
This will have the effect of all the above links inheriting the protocol from the parent page.
Of course this depends on you having valid SSL certs on the domains you're serving the different files form.
One other thing to note also is that images in your pages or CSS that are done using data URI could also cause mixed content warnings in IE.
To find out what files are causing issues, I recommend using Fiddler
There is also another tool that a fellow SO user, Eric Law wrote:
Install it from http://www.bayden.com/dl/scriptfreesetup.exe and you will get a different mixed content prompt which shows the exact URL of the first insecure resource on the page. That tool is basically a prototype and you should uninstall it when you're done with it. It works on IE8 and you should install it as admin.