Mixed Content: Using SSL

[John Lirac]

Was able to add ssl into it running via nginx. I am able to load the fusio login page but unable to login. Chrome error says:

Mixed Content: The page at 'https://site.com/apps/fusio/login' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://site.com/index.php/authorization/token'. This request has been blocked; the content must be served over HTTPS.

I had a workaround by editing the apps/fusio/index.html by adding <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

I thought this resolves the issue however, I had to eddit other apps' index file and add the line. Do we have an easier workaround? or am I missing something in the etc/nginx/sites-available/fusio file settings? thanks

[Christoph Kappestein]

Hi,

this sounds like your FUSIO_URL at the env files was not configured using https, but you can also adjust the url directly at the index.html file, simply update the FUSIO_URL variable using https then the app should also make https requests.

If everything is on https you also dont need to add any workaround.

best regards

Christoph

[John Lirac]

This works. Thanks mate.