0

I have an issue with the HTTPS header for the ExpressionEngine control panel where the JS is being disabled. It keeps generating error messages where HTTP is being loaded over HTTPS (see below):

Mixed Content: The page at 'https://domain.com/sitebox/?/cp/homepage' was loaded over HTTPS, but requested an insecure script 'http://domain.com/sitebox/?S=0&D=cp&C=javascript&M=combo_load&ui=core,widget,mouse,position,sortable,dialog,button&plugin=ee_interact.event,ee_broadcast.event,ee_notice,ee_txtarea,tablesorter,ee_toggle_all,nestable&file=react/react.min,react/react-dom.min,json2,underscore,cp/global_start,cp/form_validation,cp/sort_helper,cp/form_group,cp/modal_form,cp/confirm_remove,cp/fuzzy_filters,components/no_results,components/loading,components/filters,components/filterable,components/toggle,components/select_list,fields/select/select,fields/select/mutable_select,fields/dropdown/dropdown&v=1557994073'. This request has been blocked; the content must be served over HTTPS.
?/cp/homepage:1

Mixed Content: The page at 'https://domain.com/sitebox/?/cp/homepage' was loaded over HTTPS, but requested an insecure script 'http://domain.com/sitebox/?S=0&D=cp&C=javascript&M=combo_load&file=cp/global_end&v=1557994052'. This request has been blocked; the content must be served over HTTPS.

The base and site URLs have been updated to cater for HTTPS. Also, the SSL is being forced in the .htaccess file and the themes URL should pick up the protocol using the PHP rule below—

// Declaring site variables
$domain = $_SERVER['HTTP_HOST'];
$protocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https://' : 'http://';
$base_url = $protocol . $domain;

// Theme URL
$config['theme_folder_url'] =  $base_url . "/". $themes_folder;

The basic troubleshooting has been covered but not having much success.

Can anyone suggest a way around this please?

New contributor
friday_james is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Have you tried just hard coding those values in your config (with the https protocol) instead of trying to detect them via PHP? Depending on your server setup, sometimes the HTTPS value isn't set at all – jrothafer Aug 12 at 19:26
  • Hi @jrothafer thanks for the reply. I updated the $protocol variable to equal 'https://' but the same things occur. The base, site and themes URLs do match loading under to 'https://'. It's mainly the themes script that won't under 'https://'. The ExpressionEngine assets were uploaded from a local environment without having a 'https://' or SSL certificate. Would it be best to do a complete fresh EE installation or could the 'http://' URLs be updated in the database? Not sure is this a cache or configuration issue. – friday_james Aug 13 at 9:12
0

Your site will load those JavaScript assets from the Control Panel via the cp_url setting. Try setting that:

https://docs.expressionengine.com/latest/general/system-configuration-overrides.html#cp_url

$config['cp_url'] = 'https://domain.com/sitebox/';

That may not be the exact one, but this isn't a themes path issue, it's a CP path issue. Also check it in your CP settings, as you can set it there as well.

  • Thanks for the suggestion. I've updated the $config['cp_url'] to the admin link and both the variable and CP setting link match. However, the JS are still generating the mixed content errors for the JS scripts. I tried locating the JS raw files to see if the http:// references can be updated externally but it looks that all the assets are compressed. Is there a file location where all the control panel JS assets can be edited? – friday_james Aug 13 at 15:26
  • A controller generates that output, finding the raw files won't help. I'm not sure where something is set wrong, but this is really just a setting issue somewhere. Double check your Control Panel settings, and go over the system configuration variables, and triple check everything is set to https. And clear your browser cache. – jrothafer Aug 13 at 16:07
0

I've had issues with loading js resources on every single EE project I've worked on (5 at this point) and every time I've had to contact the server host and have them whitelist an action in mod_security. Check your network headers and see if you're getting any 500 status errors.

Your Answer

friday_james is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.