# MediaFire onebox uses insecure image
**URL:** https://meta.discourse.org/t/mediafire-onebox-uses-insecure-image/58520
**Category:** Support
**Tags:** onebox
**Created:** [March 7, 2017, 6:03am UTC](https://meta.discourse.org/t/mediafire-onebox-uses-insecure-image/58520 "2017-03-07T06:03:39Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [March 7, 2017, 6:03am UTC](https://meta.discourse.org/t/mediafire-onebox-uses-insecure-image/58520/1 "2017-03-07T06:03:39Z")
Going through some posts on Stonehearth, I discovered a page with a mixed content warning. I went ahead and changed the link from http to https, but it seems that the onebox is including an insecure image. I saw a topic from 2 years ago that’s seemed similar ([old topic](https://meta.discourse.org/t/dont-load-http-onebox-images-when-using-https/27530)). I’m hoping that if this is the same issue there might now be a solution.
Here’s the link causing the issue:
`https://www.mediafire.com/file/1ntykblml3x818v/magical_jobs.smod`
> **[magical\_jobs](https://www.mediafire.com/file/1ntykblml3x818v/magical_jobs.smod)**
>
> MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 7, 2017, 7:18am UTC](https://meta.discourse.org/t/mediafire-onebox-uses-insecure-image/58520/2 "2017-03-07T07:18:25Z")
How is this a bug? That’s gonna happen any time someone hotlinks an image from a http source. There’s no real solution, other than disallowing all http content.
---
### Author:  [@Lutz](https://meta.discourse.org/u/Lutz)
#### Post date: [March 7, 2017, 8:05am UTC](https://meta.discourse.org/t/mediafire-onebox-uses-insecure-image/58520/3 "2017-03-07T08:05:32Z")
> [@codinghorror](#):
>
> There’s no real solution, other than disallowing all http content
Not even I see this as a bug 😉
But, is it possible to disable https linking without nginx magic?
It would be a nice feature for security reasons. E.g. The user could get a warning when he try to onebox http content: “This is not allowed here for security reasons”.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 25, 2018, 10:36am UTC](https://meta.discourse.org/t/mediafire-onebox-uses-insecure-image/58520/4 "2018-01-25T10:36:31Z")
I _think_ this is resolved now because the oneboxes will download the remote image, thus converting them to https if the discourse site itself is https.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [January 25, 2018, 1:29pm UTC](https://meta.discourse.org/t/mediafire-onebox-uses-insecure-image/58520/5 "2018-01-25T13:29:10Z")