HTTPS iframe in HTTP page, browser false warnings

Question

I have a facebook tab which is setup with a typical html form, that utilizes mod_rewrite to default to HTTPS because of sensitive data.

When a facebook user (without secured browsing) hits it with HTTP protocol, FF 23 and IE 10.0.9 throw error saying there is a protocol mismatch between the url and iframe(facebook tab). I think this feature was created to catch HTTPS pages with HTTP content on them, but in this case it's the opposite. These browsers don't care. The user has to "opt-in" to allow the rest of the site to load, making the user experience less than enjoyable, mostly because it kills some javascript.

Has anyone experienced this issue. If yes, what was your solution.

Thank you.

Answer 1

Same Origin Policy as specified in RFC 6454 Subsection 3.2 covers the protocol, host, and domain.

Iow: Sorry, it's as designed.