# Changing force\_https does not update the url of uploaded images causing a mixed content warning
**URL:** https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290
**Category:** Bug
**Created:** [November 25, 2020, 2:21pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290 "2020-11-25T14:21:50Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@JanKanis](https://meta.discourse.org/u/JanKanis)
#### Post date: [November 25, 2020, 2:21pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/1 "2020-11-25T14:21:50Z")
I just enabled `force_https` on my Discourse installation. The https termination is handled by a reverse proxy in front of it. Enabling `force_https` switches most of Discourse’s internal links to https, but not those for already existing images and specifically favicons and logo. Now accessing my site over https causes a mixed content warning due to the non-https images being included.
The links can be made to be https by re-uploading the images or by executing `SiteIconManager.ensure_optimized!` from the rails console, so apparently the link is being cached somewhere and not updated when `force_https` is changed.
Discourse should update the links to its uploaded images (and probably all uploads) when `force_https` is toggled. Or even better would be to not include the scheme in those links, though I don’t know if that is possible.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 25, 2020, 3:33pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/2 "2020-11-25T15:33:41Z")
How did you install? `Force_https` is enabled by default for quite a while now.
---
### Author:  [@JanKanis](https://meta.discourse.org/u/JanKanis)
#### Post date: [November 25, 2020, 3:43pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/3 "2020-11-25T15:43:47Z")
I build docker images (split web\_only and data) with the discourse\_docker repository, and I run the images in a Kubernetes cloud behind a proxy that handles https termination. The discourse container only listens on port 80 and I did not enable the ssl and letsencrypt templates in the container configuration file. It appears that the letsencrypt template is what sets `force_https` to true, so for my setup it was not enabled by default.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [November 25, 2020, 5:24pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/4 "2020-11-25T17:24:14Z")
> [@pfaffman](#):
>
> is enabled by default
Not entirely, it’s enabled upon provisioning, but the default site setting is `false`.
>
I’ve also seen people disabling the site setting while trying to troubleshoot issues because it is shown as a ‘changed’ setting.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [November 25, 2020, 5:26pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/5 "2020-11-25T17:26:11Z")
> [@JanKanis](#):
>
> I run the images in a Kubernetes cloud behind a proxy that handles https termination.
Make sure that your proxy is sending all the necessary headers set in the nginx configs here:
> [@Run other websites on the same machine as Discourse](https://meta.discourse.org/t/running-other-websites-on-the-same-machine-as-discourse/17247/):
>
> @pfaffman edited this heavily 2022.02.24. Blame me if it’s broken. If you want to run other websites on the same machine as Discourse, you need to set up an extra NGINX or HAProxy proxy in front of the Docker container. NOTE: This is for advanced admins This guide assumes you already have Discourse working - if you don’t, it may be hard to tell whether or not the configuration is working. You cannot use ./discourse-setup to set up Discourse if another server is using port 80 or 443. You will…
In particular, X-Forwarded-Proto is often not included by default.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [November 25, 2020, 5:29pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/6 "2020-11-25T17:29:57Z")
This is an issue even if the proxy is sending the `X-Forwarded-Proto` header and all.
Toggling the `force_https` site setting will not update the logo URL protocol until the `icon_manager` cache has been cleared. Adding force\_https to the [watched settings](https://github.com/discourse/discourse/blob/master/lib/site_icon_manager.rb#L20) for the icon manager is probably the easiest solution.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 25, 2020, 5:55pm UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/7 "2020-11-25T17:55:58Z")
> [@RGJ](#):
>
> Not entirely, it’s enabled upon provisioning, but the default site setting is `false` .
Right! If you do a [standard install](https://meta.discourse.org/t/142537?silent=true), it’s set automatically, which is why I suspected that this wasn’t a [standard install](https://meta.discourse.org/t/142537?silent=true).
I’m pretty sure that on the GKE site that I manage it’s set with a `DISCOURSE_FORCE_HTTPS` environment variable and it works as expected. But it was a long while ago that I set that up, so I could be forgetting something.
---
### Author:  [@irwinstar](https://meta.discourse.org/u/irwinstar)
#### Post date: [December 14, 2020, 8:37am UTC](https://meta.discourse.org/t/changing-force-https-does-not-update-the-url-of-uploaded-images-causing-a-mixed-content-warning/171290/8 "2020-12-14T08:37:07Z")
I checked this force https setting, and enable it again.
And it’s worked for me.
