SOLVED: ModX in SSL: Error: This page contains both secure and nonsecure items.

I know what this error means, but my problem is that if I tell Internet Explorer 6 to show all items, it does, and it works great, however, if I tell it NOT to show nonsecure items, I get a Javascript error.

My question is how do I tell what the nonsecure part of the page is? I’d really like to have all pages secure, and not popping up that secure/nonsecure elements notification. I’ve checked the source of the page, and the only item loading from an http:// address is for Google Analytics, and I get the same error even if I take out the analytics stuff. None of my pages are set to cache, so that’s not the issue.

All URLs are relative, and my base href is the proper https:// URL. This is driving me crazy! Anyone have any ideas?

The page is at https://www.npfunds.com.

Might be worth noting that I use AjaxSearch, Wayfinder, and Ditto snippets.

Thanks!

It looks like your javascript links are being resolved as http; have you tried using an absolute URL for them?

The problem is that I’m not sure which javascript files are being linked that way, or from where they are being linked. I was hoping to figure out I could find out which files are causing the issue. Any ideas how I should go about doing that?

Thanks for your response!

Quote from: ganeshXL at Jan 06, 2008, 04:44 PM

Use https google-analytics JS reference: http://www.google.com/support/googleanalytics/bin/answer.py?hl=en&answer=55483

Thanks for that, but I tried it originally, as mentioned in the first post

As a matter of fact, I haven’t *solved* teh problem yet, but I have determined that the culprit is my my call to AjaxSearch, which looks like this:

[!AjaxSearch? &AS_showResults=`1` &ajaxSearch=`1` &extract=`1` &addJscript=`1` !]

My guess is that the problem is with the &addJscript=`1`

I’ll keep looking and see if I can figure it out. I can’t believe no one else has experienced this! Or perhaps they have. Armed with this new information, I’ll check out the AjaxSearch forum.

Update: Problem seems to originate in AjaxSearch.js, and problem now occurs only in IE (at least in IE 6), and not in Firefox (which displays the page as fully secure). Why would IE see a page as not 100% secure, while Firefox accepts that everything is coming from a secure location?! I would be grateful to anyone who can shed some light on this. I’m using AjaxSearch 1.6, but I’m worried that upgrading to the new 1.7 will complicate things, as I’m now working with a live, in-production system. An example of the issue is here: https://www.npfunds.com/secure-ssl-test-page

Quote from: ganeshXL at Jan 16, 2008, 07:46 PM

I googled around a bit. Seems like mootools is the culprit: http://dev.mootools.net/ticket/139

Thanks so much for looking. I was really excited that this was the issue, especially when I saw the update needed to be made in my version of mootools, but I made the change, saved the file, cleared my cache, and meta-refreshed my browser, and it didn’t help. I still can’t understand why this doesn’t affect anyone else! Does no one else use AjaxSearch on an SSL page? Or, if the problem had been mootools, wouldn’t someone have noticed that it was causing issues?

It’s so frustrating, because I’ve spent the whole day trying to fix this, and I’m not a programmer :-/

Thanks again for your help - I’m prepared for any other suggestions

Okay, so it looks like AjaxSearch loads via Window.onDomReady, and the version of mootools that came with my Modx installation didn’t support onDomReady for SSL. Apparently since no one but me has run into this up to now, I don’t expect it’ll be a problem in the future, but in case it is, here’s the solution, for the record.

Thanks, GANESHXL - you were correct that it was a problem with mootools - just not the exact problem I thought, since patching the line they suggested didn’t work for me. One of the mootools people stated it pretty simply in their forum: "v1 version of domready doesnt work with ssl. v1.1 does, but its not out yet." (Luckily it’s out now)