Favicon does not work with SSL

Question

I have a website on a SSL host. It has a favicon which is referenced by a domain-relative URL:

<link rel="shortcut icon" type="image/x-icon" href="/contextpath/favicon.ico"/>

When SSL is off, it works, but when SSL is on, it doesn't work. How can I get favicon to work with SSL?

Answer 1

By design, favicons have been removed from the location bar in recent versions of Firefox. This is mainly to prevent downgrade attacks where the attacker is able to provide a favicon looking like a lock, thereby making the user believe that they're using HTTPS when they're not.