javascript - Deezer content is served over HTTP

Question

I am using Deezer Javascript SDK and loaded it over https.

<script src="https://cdns-files.deezer.com/js/min/dz.js"></script>

But from today Chrome and Firefox has problem, because Deezer SDK loading some script over https and Chrome rejected as insecure content.

Chrome console:

Mixed Content: The page at 'https://....' was loaded over HTTPS, but requested an insecure script 'http://www.deezer.com/js_trad-v00340851.php?l=cs'. This request has been blocked; the content must be served over HTTPS. playerBB.php:1 Mixed Content: The page at 'https://....' was loaded over HTTPS, but requested an insecure script 'http://cdn-files.deezer.com/js/min/core-v00340851.js'. This request has been blocked; the content must be served over HTTPS. playerBB.php:1 Mixed Content: The page at '...' was loaded over HTTPS, but requested an insecure script 'http://cdn-files.deezer.com/js/min/live-v00340851.js'. This request has been blocked; the content must be served over HTTPS.

Answer 1

This happens when your page and remote resource are using different HTTP protocols: one uses HTTP and another uses HTTPS.

The preferred way to include third-party scripts is this one:

<script src="//cdns-files.deezer.com/js/min/dz.js"></script>

Removing https: or http: tells browser to load the document using same protocol as current page. This should eliminate security warnings.