# Twitter oneboxed content breaking ssl
**URL:** https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670
**Category:** Bug
**Created:** [June 5, 2015, 3:37am UTC](https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670 "2015-06-05T03:37:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@watchmanmonitor](https://meta.discourse.org/u/watchmanmonitor)
#### Post date: [June 5, 2015, 3:37am UTC](https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670/1 "2015-06-05T03:37:23Z")
I just posted a twitter link on my hosted discourse, and the page no longer had a nice ssl lock.
I see this:
```plaintext
Mixed Content: The page at 'https://forum.somedomain.com/t/pricing/43/3' was loaded over HTTPS, but requested an insecure image 'http://pbs.twimg.com/profile_images/518242033811472386/VKcAQvEB_normal.png'. This content should also be served over HTTPS.
2ember.prod:3051 Mixed Content: The page at 'https://forum.somedomain.com/t/pricing/43/3' was loaded over HTTPS, but requested an insecure image 'http://pbs.twimg.com/profile_images/518242033811472386/VKcAQvEB_normal.png'. This content should also be served over HTTPS.
discourse/lib/Markdown.Editor:995 Mixed Content: The page at 'https://forum.somedomain.com/t/pricing/43/3' was loaded over HTTPS, but requested an insecure image 'http://pbs.twimg.com/profile_images/518242033811472386/VKcAQvEB_normal.png'. This content should also be served over HTTPS.
ember.prod:3051 Mixed Content: The page at 'https://forum.somedomain.com/t/pricing/43/3' was loaded over HTTPS, but requested an insecure image 'http://pbs.twimg.com/profile_images/518242033811472386/VKcAQvEB_normal.png'. This content should also be served over HTTPS.
```
and I know that all the calls to `http://pbs.twimg.com` could be `https://pbs.twimg.com`
Is this a fix that the discourse team can pull off? or is it up to the official twitter setup?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [June 5, 2015, 5:31am UTC](https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670/2 "2015-06-05T05:31:29Z")
Not sure, is this something that could be fixed in the oneboxer @techapj with protocol independent URLs?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [June 5, 2015, 6:42am UTC](https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670/3 "2015-06-05T06:42:25Z")
Protocol-independent URLs are incorrect here, it should be HTTPS always - Twitter is in the HSTS preload lists.
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [June 9, 2015, 6:05pm UTC](https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670/4 "2015-06-09T18:05:28Z")
Fixed via:
[https://github.com/discourse/onebox/commit/d5bf777449b639fcbf41f693e995d3533b6bf108](https://github.com/discourse/onebox/commit/d5bf777449b639fcbf41f693e995d3533b6bf108)
---
### Author:  [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [June 9, 2015, 6:07pm UTC](https://meta.discourse.org/t/twitter-oneboxed-content-breaking-ssl/29670/5 "2015-06-09T18:07:23Z")