且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

iOS9不会从安全页面加载不安全的资源(SSL / HTTPS)

更新时间:2022-03-19 21:35:38

这与ATS无关。 WebKit强制执行混合内容策略,当通过https提供主机页面时,该策略禁止访问某些活动内容(JS,CSS等),而不是通过不安全的连接加载。

This is not related to ATS. WebKit enforces a mixed content policy that disallows access to certain classes of "active" content (JS, CSS, etc) from being loaded over an insecure connection when the host page is being served over https.

如果您在检查器中检查您的页面,您将在错误面板中看到此报告。

If you examine your page in the Inspector you will see this being reported in the error panel.

跟进:您无法关闭混合内容阻止。允许不安全的CSS或JS会将整个页面的安全性降低到安全性最低的资源的安全性。如果你必须通过http加载css / js的解决方案是通过http加载整个页面。这样,用户看到的UI正确反映了内容的安全性。

Follow up: You can't turn off mixed content blocking. Allowing insecure CSS or JS reduces the security of the entire page to that of the least secure resource. The solution if you must load css/js over http is to load the entire page over http. That way the UI seen by the user correctly reflects the security of the content.