https and images from another site. How to remove warnings for http images using php or javascript without modifying .htaccess file?

Question

I have an ssl certificate on my web-site. Once images are loaded on the page from another site, it causes warnings kind of "the page contains both secure and nonsecure items", so you have to press OK or you see "broken" ssl connection in the browser. One of the ways to escape that warnings is to use http page instead of https, correct?

But, as far as I know, there is another way to exclude that warnings using php or just using javascript. I believe the images are loaded to the temporary folder on my server and are loaded as https images at the same time. Could anybody tell me the best way to do that? Browsing the forum didn't help me a lot. Thank you.

So, how to load

<?php echo '<img src="http://www.not_my_site.com/image.jpg" alt="">'; ?>

with no warnings on my page https://my_site.com/index.php ?

Answer 1

You cannot surpress the error as it's a browser thing.

The only way would be to wrap those calls using an https call on your site. Something like:

<?php echo '<a href="https://my_site.com/external.php?resource=http://www.not_my_site.com/image.jpg" alt="">'; ?>

You will have to write the external.php script to make the request on the client's behalf, and then return the content over your existing SSL connection. You only NEED to do this for external HTTP-only resources.

The process would work as follows:

1. The end user's web browser makes an HTTPS request to your external.php script.
2. Check for a saved copy of the resource. If you've got it cached then skip to step 6, returning the cached resource.
3. Your server forwards on the call to the HTTP resource specified as the resource.
4. The remote server responds to the request.
5. Save a copy of the resource for caching.
6. Your web server external.php script then returns that response over the SSL connection.

The web browser only makes 1 request, your web server just has to make an additional one.

This is the only way you'll be able to get rid of the message.

---

Looks even simpler to retrieve the image: use curl to download indirect image file