What is mixed content?

Short answer

Mixed content is a page opened with HTTPS loading resources such as images, scripts, styles or iframes over unencrypted HTTP. Since unencrypted resources can be read and modified on the way, browsers block resources such as scripts, styles and iframes, try to upgrade images to HTTPS, or show a warning in the address bar. In TR7, the situation is mostly seen in setups where TLS is terminated on TR7: since the Backend Service receives the request unencrypted, the application can generate the links on the page with http://. The Redirect to HTTPS action or the HTTP → HTTPS frontend protocol moves the page itself to HTTPS but does not change the http:// addresses inside the page; these addresses are fixed in the application or handled with the Set HTTP Header, Add HTTP Header and Modify Response Content actions.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Load Balancer vService List → HTTP vService form → Frontend	Protocol → Redirect → HTTP → HTTPS	Redirecting the unencrypted request to the HTTPS address
Load Balancer → Actions (Policy Actions)	Redirect to HTTPS	Redirecting to HTTPS depending on a condition
Load Balancer → Actions (Policy Actions)	Set HTTP Header	Passing to the Backend Service the header that reports that the request is HTTPS (X-Forwarded-Proto: https)
Load Balancer → Actions (Policy Actions)	Add HTTP Header	Making the browser upgrade the requests by adding Content-Security-Policy: upgrade-insecure-requests to the response
Load Balancer → Actions (Policy Actions)	Modify Response Content	Changing the http:// addresses in the response body

The steps of the methods and which one to choose when: After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?

Common Misconceptions

• "An HTTPS redirect solves mixed content." The redirect changes the address of the page; it does not change the http:// resource links in the page code.
• "Mixed content affects only the appearance." The scripts and styles that the browser blocks can break the functioning of the page.
• "The problem is in TR7's certificate." The warning appears even if the certificate is valid; the cause is that the page requests resources from an unencrypted address.

How it is done in the documentation

• Redirect to HTTPS · Operational and Safe Usage Recommendations
• HTTP (L7) vService · Protocol
• Modify Response Content

Related questions

• After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?
• What is the difference between HTTP and HTTPS?
• How do I redirect HTTP to HTTPS?