For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jplopezy_118145's avatar
jplopezy_118145
Icon for Nimbostratus rankNimbostratus
Sep 19, 2014

IFRAME HTTP TO HTTPS (MIXZONE)

Dear,

 

I have the following problem. I have seen that there are two topic about this but I can not fix it in any way.

 

The problem is as follows:

 

I have 2 VS (http and https) - POOL - http node 1 only

 

What I do is use the HTTP VS the common irule from http to https.

 

The VS https traffic and takes up the pool after mand.

 

Everything is oka.

 

E problem occurs when loading an iframe, is that when I programmed (closed code) requires http put in the iframe generating mixed zone in the famous browsers.

 

What I need is a irule or some way to convert iframe to https before you open it or is there any way?

 

/ span>

 

regards ( sorry english)

 

application delivery
devops
iRules

5 Replies

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Sep 19, 2014

    If I understand you correctly there is an iframe on a secure page that, but the iframe contents are not secure. This is causing a "mixed content" security alert in the browsers.

     

    Some questions:

     

    1. Where is the page hosted that is loaded in the iframe?
    2. Is the page that uses the iframe hosted by you?
    3. Is the page that is loaded in the iframe accessible via HTTPS?

    Depending on your answers there may be more questions.

     

  • jplopezy_118145's avatar
    jplopezy_118145
    Icon for Nimbostratus rankNimbostratus
    Sep 19, 2014
    Where is the page hosted that is loaded in the iframe?

In the same site that the VS example : VS: test.com IFRAME : test.com

Is the page that uses the iframe hosted by you?

Yes, is the same site, but i don't have access to the admin of the server.

Is the page that is loaded in the iframe accessible via HTTPS?

If i don't have allow http to https all is oka, only when  the access is from https the iframe display http and don't load the content. The links is accessible via https is a pdf file.

    regards

  • Arie's avatar
    Arie
    Icon for Altostratus rankAltostratus
    Sep 19, 2014

    The problem is that the HTML seems to include a hard-coded link to the resource, including the protocol. Example:

    src="http://www.domain.com/document/file.pdf"

    The best way to resolve this issue is to get the editor/developer to fix the HTML, something like:

    src="/document/file.pdf"

    That way the request will inherit the protocol.

    If it's not possible to get someone to fix the HTML you can use the BIG-IP to manipulate the HTML.

  • jplopezy_118145's avatar
    jplopezy_118145
    Icon for Nimbostratus rankNimbostratus
    Sep 20, 2014

    Arie

     

    Thanks, yes this is the problem the desing guy of the app hard-coded the protocol, have you got some irule to make this type of change in the code?

     

    regards

     

    • Arie's avatar
      Arie
      Icon for Altostratus rankAltostratus
      Sep 23, 2014
      That's certainly an option, but before going there can you confirm whether it's possible to fix the HTML at the source?