How to identify insecure content in Chrome DevTools or Firefox?

Question

My web page sometimes (rarely) shows "there are some insecure resources" warning icon (yellow lock) like in the screenshot below. However that occurs rarely and now I caught another one I don't want to miss it again so I can't risk losing the page.

The page is at the URL: https://eksisozluk.com/sedat-kapanoglu-ve-40-kisiye-hapis-talep-edilmesi--3960310 . You will probably not see the warning (unless it's Firefox) because I didn't in my consecutive tries on Chrome and I was logged in when I got the error. So let's assume you and I will never see that warning icon on Chrome again.

Devtools was not open when I was using the site, so "Network" tab is empty. That part won't work.

"Resources" shows all JS and CSS entries as https there is no single resource from http there.

The page has jQuery loaded so I tried queries $('*[href^="http:"]') and $('*[src^="http:"]') to no avail. The page contains some external http links (not resources, plain a href's) but that wouldn't trigger the alarm.

I'm using Kaspersky Anti-Virus and it uses a proxy to scan incoming/outgoing traffic. That could be causing some trouble although I haven't had any issues so far with other web sites.

I tried "view page source" and searching it for http resources but only tag with http resource link was:

<meta name="twitter:image" content="http://eksisozluk.com/content/img/ilogo120.png" />

which actually exists in the page when the icon is green too. So that cannot be the reason.

Isn't there a way to directly view the "insecure content" whatever that is in Chrome?

When I view the page in Firefox it says "partially encrypted" but it doesn't show what's not encrypted either. All the items in "Media" tab start with "https://".

Actually now I'm able to reproduce the issue continuously on Firefox. I looked at the network tab and "nothing" shows as http:// yet Firefox tells me "partially encrypted". I'm not sure if Firefox is saying that for the same reason Google does (because Firefox is consistent and insistent about it), but I'm providing both scenarios in case they belong to the same root cause.

I finally wrote this code in Chrome console to find the culprit:

$("*").each(function (index, elem) {
  var attrs = elem.attributes;
  for(var n = 0; n < attrs.length; n++) {    
    var attr = attrs[n];
    if(attr.nodeValue.indexOf("http://") >= 0) {
      console.log("FOUND: <" + elem.nodeName + " " + attr.nodeName + "='" + attr.nodeValue + "'>");
      console.log($(elem));
    }
  }
});

The output shows no interesting stuff. Only <META content> for twitter reference, <A href>s and two <TD title="http://...">s that Mvc-Mini-Profiler inserted. None of them justify the warning of course. Here is the full output: http://pastebin.com/kgV8XHgN

So this looks really interesting. There is NOT a single element in DOM that contains an "HTTP" link yet Chrome warns about "insecure" content. I'm very troubled by it.

There are NO iframes on the page. ($("iframe") returns [])

EDIT: DAMN I lost the page :( (navigated to a link and back button turned to SSL icon to green). I knew it wouldn't last long. But I still appreciate any help since it wasn't the first time I saw that issue.

Answer 1

Just had this problem – if you check the Javascript Console in Chrome it will now tell you where the problem lies.

Answer 2

I had the same issue yesterday, and found http://www.whynopadlock.com/

It shows which elements are not secure, and it also verifies certificate chains.

Btw, if your site can be loaded both http and https, then omit http: from external urls.

Not:

src="http://external.dom/external.js" or "https://external.dom/external.js"

Just:

src="//external.dom/external.js"

Then the browser will use http or https depending on what the page is loaded as