Mixed Content: The page at '<URL>' was loaded over HTTPS, but requested an insecure font '<URL>'. This request has been blocked; the content must be served over HTTPS And 40 requests for fonts from discourse-fonts gem. This is a fresh installation where Postgres and Redis is run on a separate serve…

Did you enable the force https setting?

Most probably no. Where do I set it? And why should it be needed in the first place instead of having the CSS request static assets over https or relative references ? FWIW - on the outside facing webserver I do have the typical 301 set Edit: Found the setting based on this post , thank you @Arkshin…

I’m unsure why you have an http link somewhere; https should be enforced regardless. You can find in the search bar: [image]

[图片] Arkshine: I’m unsure why you have an http link somewhere Well, me neither. I didn’t modify anything. Just the regular launcher build app These URLs seem to be in the processed CSS, which I obviously didn’t touch (nor the scss) in any way. I didn’t find anything https related in the app.y…

FORCE_HTTPS tells Discourse to rewrite requests. It’s necessary even if you’re doing ssl encapsulation outside the container to avoid the issue you’re describing.

It depends how we define “necessary”. Currently it might be necessary to work around the actual problem, which is that compiled CSS files reference static assets explicitly using http schema. But IMHO this should not be necessary in the long run

Necessary as in it’s the purpose of FORCE_HTTPS - that’s how you tell Discourse that it’s being served securely and to rewrite links as such.

So what factors/conditions would impact the assets (JS/CSS) URL protocol HTTP/HTTPS? If you comment out below, and your site access from HTTP, then assets URL will be HTTP as well #- "templates/web.ssl.template.yml" #- "templates/web.letsencrypt.ssl.template.yml" In this case, if you enable f…

As mentioned in the original post, in my case certificate and everything is correct and valid but all connections to the outside are handled by a reverse-proxy (nginx, obviously ;-), while connection to discourse goes over unix socket. Meaning I have templates/web.socketed.template.yml rather than…

不安全的字体请求

支持

silverdr (Silver Dream !) 2023 年4 月 11 日 13:02 7

这取决于我们如何定义“必要”。目前，可能需要解决实际问题，即编译后的 CSS 文件显式地使用 http 协议引用静态资源。但恕我直言，从长远来看，这不应该是必要的。

话题		回复	浏览量
Discourse always generates links to itself with http: rather than https: Support	3	701	2018 年12 月 10 日
Discourse not aware of SSL termination (mixed content) Self-hosting	7	2036	2019 年8 月 8 日
If I force Discourse to use HTTPS without checking every resource, what happens? Support	7	2081	2018 年2 月 20 日
Switched to HTTPS, 1 of the rss link is http Support	10	2111	2016 年2 月 23 日
Mixed Content: The page at '<URL>' was loaded over HTTPS error Support	6	7717	2022 年1 月 31 日

不安全的字体请求

相关话题