https://www.upworthy.com/ has analytics scripts blocked by mixed content blocking

NEW
Unassigned

Status

Tech Evangelism
Desktop
P5
minor
5 years ago
3 months ago

People

(Reporter: tanvi, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [mcb-chrome30+][mcb-ie][mcb-thirdparty-notified] [sitewait], URL)

(Reporter)

Description

5 years ago
Mixed content blocking is a feature that prevents insecure elements on secure pages from loading. In Firefox 23, this feature will default to blocking "active" insecure content, which may break some web sites. 

More information on Firefox's Mixed Content Blocker is below: 
http://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/

The security feature is currently breaking the HTTPS version of www.upworthy.com. It also appears to be functioning incorrectly in Chrome 29+ and IE10.

Here is a list of the active, HTTP resources that were blocked on https://www.upworthy.com: 

Blocked loading mixed active content "http://fonts.googleapis.com/css?family=Droid+Serif:700,700italic|Source+Sans+Pro:400,700,400italic,700italic" @ https://www.upworthy.com/
Blocked loading mixed active content "http://analytics.upworthy.com/event" @ https://d29sy0p5c9gskd.cloudfront.net/assets/application-02aa31100d3c19d80bd0885c2a3cfed0.js:26

The bigger (user facing) issue is on https://www.upworthy.com/every-war-on-drugs-myth-thoroughly-destroyed-by-a-retired-police-captain?g=2&c=bl3, where a youtube video embed is blocked.  To fix this, simply update the youtube url from http://youtube.com to https://youtube.com.  The resoucres blocked on this page are:

Blocked loading mixed active content "http://www.youtube.com/embed/W8yYJ_oV6xk?rel=0&wmode=transparent&showinfo=0&controls=1&enablejsapi=1&rel=0" @ https://www.upworthy.com/every-war-on-drugs-myth-thoroughly-destroyed-by-a-retired-police-captain?g=2&c=bl3
Blocked loading mixed active content "http://fonts.googleapis.com/css?family=Droid+Serif:700,700italic|Source+Sans+Pro:400,700,400italic,700italic" @ https://www.upworthy.com/every-war-on-drugs-myth-thoroughly-destroyed-by-a-retired-police-captain?g=2&c=bl3
Blocked loading mixed active content "http://www.youtube.com/embed/W8yYJ_oV6xk?rel=0&wmode=transparent&showinfo=0&controls=1&enablejsapi=1&rel=0" @ https://d29sy0p5c9gskd.cloudfront.net/assets/application-451c5e6fa0d2a7828032e31dba8f1fbf.js:25
Blocked loading mixed active content "http://analytics.upworthy.com/event" @ https://d29sy0p5c9gskd.cloudfront.net/assets/application-451c5e6fa0d2a7828032e31dba8f1fbf.js:26

This was originally reported by an upworthy.com user in bug 891378.
(Reporter)

Comment 1

5 years ago
Anyone have a contact from upworthy.com?
Whiteboard: [mcb-chrome29+][mcb-ie] → [mcb-chrome29+][mcb-ie][mcb-no-contact]
Emailed their hello@upworthy.com address with pointers to this bug and more info.
(Reporter)

Updated

5 years ago
Whiteboard: [mcb-chrome29+][mcb-ie][mcb-no-contact] → [mcb-chrome29+][mcb-ie][mcb-thirdparty-notified]
(Reporter)

Updated

5 years ago
Whiteboard: [mcb-chrome29+][mcb-ie][mcb-thirdparty-notified] → [mcb-chrome30+][mcb-ie][mcb-thirdparty-notified]

Updated

4 years ago
Component: English US → Desktop
Still an issue. Setting [sitewait] since the site was contacted (I understand you had thirdparty-notified whiteboard tag for that..)
Whiteboard: [mcb-chrome30+][mcb-ie][mcb-thirdparty-notified] → [mcb-chrome30+][mcb-ie][mcb-thirdparty-notified] [sitewait]
The YouTube issue is now fixed, and I see no broken functionality on https://www.upworthy.com

Firefox does however still warn that resources are blocked. Seems all of them are from http://analytics.upworthy.com/ so it's probably only the browser/usage stats system being broken at the moment.
Severity: major → minor
Summary: https://www.upworthy.com/ does not work properly because of mixed content blocking → https://www.upworthy.com/ has analytics scripts blocked by mixed content blocking
Still an issue.
Priority: -- → P5

Comment 6

3 months ago
There are no more blocked active resources, but some mixed display content.
You need to log in before you can comment on or make changes to this bug.