1094334 - Mixed Content Blocking prevents HTTP sites to load

Status: RESOLVED WONTFIX

(Webtools Graveyard :: Pontoon, defect, P5)

Description

[Matjaz Horvat [:mathjazz]]

Pontoon is hosted via HTTPS. Modern browsers prevent HTTP content from loading inside iframe. That means websites accessible only through HTTP will not load inside Pontoon, unless user explicitly tells browser to do so.

Quick fix would be to point user to the browser button for disabling blocking. But that's just a partial fix.

What other options do we have? Shall we also allow Pontoon to run on HTTP?

Comment 1

[Jobava]

>Shall we also allow Pontoon to run on HTTP?

Do you mean pontoon.mozilla.org or Pontoon the source code?

Comment 2

[Matjaz Horvat [:mathjazz]]

I mean the page itself (pontoon.mozilla.org). If you want to localize in-page, Pontoon needs to load the website in an iframe. And that's problematic if Pontoon and the website use different protocols (HTTPS vs HTTP).

Comment 3

[Matjaz Horvat [:mathjazz]]

Now that HTTPS is not only a standard at Mozilla but also free and easy to implement in general, I've made it a requirement:
https://developer.mozilla.org/en-US/docs/Mozilla/Implementing_Pontoon_in_a_Mozilla_website#B._Enable_Pontoon_on_your_site

Comment 4

[Jarek Śmiejczak [:jotes]]

I think it's the right decision. I guess it's easier to implement HTTPS by an author of apps than build some workaround that could be potentially unsafe.