Calling insecure endpoint from a website runs under HTTPS - nginx

Question

My application is running under HTTPS with a valid certificate from one of the known authorities. Unfortunately I am using a third party API which doesn't support HTTPS.

The result is the known message Mixed content: mydomain.com requested an insecure XMLHttpRequest endpoint.

Is it possible to add an exception to the web server to allow calling this API insecurely!! I am using Nginx BTW.

If not what what can be other possibilities to solve this problem.

I have a solution but I don't like it because it will be a performance drawback:

Implement an API which acts as proxy, receive the requests from the application through HTTPS and make the requests to the third party API throw HTTP.

Answer 1

I too had this issue. Everything on a page should come and request https if you are using https and don't want warning/errors. You don't need to implement an api to proxy if you are using nginx. Whatever you implement will be performance hit as you correctly surmise. Just use proxy pass in nginx. In our configuration, we have :

location /thirdparty/ {
        proxy pass http://thirdpartyserver/;
 }

Notice the trailing slash in proxy pass, I keep all third party api which are http in https://myserver/thirdparty/requesturl. Trailing slash removes thirdparty while making request. So it becomes, http://thirdpartyserver/request

Official reference: http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass