Ajax post via https from an http page

Question

I have an ajax call that really needs to be https. However, the page that it is being called from is http. The browser complains about restricted URI denied, presumably due to the same origin policy. Are there any known workaround for this?

Answer 1

Yes, that's same-origin policy stopping you. You have to use same workarounds as for cross-domain requests.

Requests from non-secure website are not secure, even if you're making requests to HTTPS URLs (because MITM attack can replace all "https" with "http"), so you should consider using HTTPS for the whole page.