# Oneboxed http link causes a TLS mixed content warning

**URL:** <https://meta.discourse.org/t/oneboxed-http-link-causes-a-tls-mixed-content-warning/60688>\
**Category:** Product Support\
**Created:** [4월 9, 2017, 4:37오후 UTC](https://meta.discourse.org/t/oneboxed-http-link-causes-a-tls-mixed-content-warning/60688 "2017-04-09T16:37:32Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![tophee](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tophee/32/73406_2.png) [@tophee](https://meta.discourse.org/u/tophee)\
**Post date:** [4월 9, 2017, 4:37오후 UTC](https://meta.discourse.org/t/oneboxed-http-link-causes-a-tls-mixed-content-warning/60688/1 "2017-04-09T16:37:33Z")

</div>

When someone posts a http link in their post and it gets oneboxed, this triggers a TLS mixed content warning (and the browser no longer displays the page as secure)

This issue has been discussed in a number of topics (see end of post) and I gather from these discussions (especially [https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103/](https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103/)) that this is a complex issue to resolve. I understand that a workaround is indent those insecure urls to make sure they don’t get oneboxed. (But this is not something to explain to the average user, especially if we want to simultaneously teach them to use oneboxes.)

What I don’t understand is what the current state of affairs is regarding this. Is this on the roadmap? Is it ultimately not fixable? Is there something the individual site-admin can do?

I believe that this topic reflects the latest state of the discussion but is seems inconclusive too:

[https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103/](https://meta.discourse.org/t/download-images-for-oneboxes-as-well-if-download-images-is-set/21103/)

So, beyond the technical debate: what can/should site-admins do about this?

* * *

Previous discussions of this issue:

> [@Twitter oneboxed content breaking ssl](https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670):
>
> I just posted a twitter link on my hosted discourse, and the page no longer had a nice ssl lock. I see this: Mixed Content: The page at 'https://forum.somedomain.com/t/pricing/43/3' was loaded over HTTPS, but requested an insecure image 'http://pbs.twimg.com/profile\_images/518242033811472386/VKcAQvEB\_normal.png'. This content should also be served over HTTPS. 2ember.prod:3051 Mixed Content: The page at 'https://forum.somedomain.com/t/pricing/43/3' was loaded over HTTPS, but requested an insecu…

[https://meta.discourse.org/t/dont-load-http-onebox-images-when-using-https/27530](https://meta.discourse.org/t/dont-load-http-onebox-images-when-using-https/27530)

> [@Links to Amazon cause a TLS mixed content warning](https://meta.discourse.org/t/links-to-amazon-cause-a-tls-mixed-content-warning/37743/):
>
> Linking to Amazon in a topic causes a mixed content warning when using https, presumably because the thumbnail is loaded from a third party over http. Would it be possible to load the thumbnail using https instead?

---

_[View the full topic](https://meta.discourse.org/t/oneboxed-http-link-causes-a-tls-mixed-content-warning/60688)._