Loading script from HTTP is automatically converted to HTTPS for some users

Question

I am trying to load socket.io using the following code:

<script src="http://cdn.socket.io/socket.io-1.4.5.js"></script>

However some users have reported the following error to me:

Failed to load https://cdn.socket.io/socket.io-1.4.5.js ERR_SSL_PROTOCOL_ERROR

Is this an automatic security setting on modern browsers? And if so can it be disabled?

Answer 1

The problem is not your fault!

Accessing that link in my browser fails as well, and inspecting the unsuccessful request shows that the following header was set:

Upgrade-Insecure-Requests: 1

This tells the browser to "upgrade" all http:// URLs to https://, which seems to mirror the error your users are reporting.

ERR_SSL_PROTOCOL_ERROR indicates that the SSL certificate for https://cdn.socket.io/ is incorrectly configured and thus the browser (rightly) assumes the worst, and chooses not to trust data served from that domain over the secure protocol. When the domain is configured to "upgrade" insecure requests to secure ones, and secure requests are rejected by the browser, it becomes clear why there is no way to access the content correctly at either URL.

I would contact the administrators of the website and inform them of the problem, or just simply switch to another CDN like Chris Chen suggested:

<script src="https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.4.5/socket.io.min.js"></‌​script>