892810 - https://www.mturk.com/ does not work properly because of mixed content blocking

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect)

Description

[Tanvi Vyas[:tanvi]]

Mixed content blocking is a feature that prevents insecure elements on secure pages from loading. In Firefox 23, this feature will default to blocking "active" insecure content, which may break some web sites. 

More information on Firefox's Mixed Content Blocker is below: 
http://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/

The security feature is currently breaking the HTTPS version of some mechanical turk pages.  Mechanical turk seems to embed HTTP iframes in many of their HTTPS pages.  Here is an example:
https://www.mturk.com/mturk/preview?groupId=2HGWQIHPCGJ2UXCY1JWXN0JPXYN71Q

Blocked loading mixed active content "http://184.72.249.63/render_hit_page_for_turk?assignmentId=ASSIGNMENT_ID_NOT_AVAILABLE&hitId=22DWJ5OPB0YVXUJ8KJ27KP9WKNC5X1" @ https://www.mturk.com/mturk/preview?groupId=2HGWQIHPCGJ2UXCY1JWXN0JPXYN71Q

<iframe height="800" scrolling="auto" frameborder="0" align="center" src="http://184.72.249.63/render_hit_page_for_turk?assignmentId=ASSIGNMENT_ID_NOT_AVAILABLE&amp;hitId=25LW5XH0JPPSZXV8CCCSV75M28FLFD" name="ExternalQuestionIFrame"></iframe>


This issue should also exist for your IE and Chrome 29+ users (although I have not confirmed on IE).

To fix this security issue, serve the embedded frame content over HTTPS and change the link in the HTML source of mturk.com to point to the https:// version of the content.

This was originally reported by a mturk user: https://input.mozilla.org/en-US/dashboard/response/3848240

Comment 1

[Tanvi Vyas[:tanvi]]

Another example:

https://www.mturk.com/mturk/preview?groupId=2VKEWY2AOO2G5DWB027Q0CMBIBB332

Blocked loading mixed active content "http://s3.amazonaws.com/Taste-of-the-World/20PKUDD8XMB39URUCPXU1O6T4OLODA-592820-123862.html?assignmentId=ASSIGNMENT_ID_NOT_AVAILABLE&hitId=2UK1O3W5XH0J8GADEYPEXLSPOJACIH" @ https://www.mturk.com/mturk/preview?groupId=2VKEWY2AOO2G5DWB027Q0CMBIBB332

Note that there are some pages where the embedded iframe is an HTTPS iframe and hence renders properly.  Here is an example:
https://www.mturk.com/mturk/preview?groupId=2J23QP6AUC26L8BA4VO3Z0GM6JO18D

Comment 2

[Matt Wobensmith [:mwobensmith][:matt:]]

Appears to be fixed now. I used both affected URLs above. Closing.

Comment 3

[Tanvi Vyas[:tanvi]]

Does anyone have a contact at Amazon?

I still see the issue on mturk pages.

Here are a couple:
https://www.mturk.com/mturk/preview?groupId=2PBXCNHMVHVKTTYQLPT7AJ7FKU113C
https://www.mturk.com/mturk/preview?groupId=294YY2AOO2GM55YJ0UHSKM6NAJ944V

You may have to click "View as HIT in this Group" for urls that no longer take you to the mturk task (because the task has expired).

From what I understand, each task has an iframe embedded in it.  The iframe may be HTTPS or it may be HTTP.  The HTTP iframes are blocked.

Comment 4

[Lukas Blakk [:lsblakk] use ?needinfo]

Submitted feedback on mturk.com to point them to this bug.

Comment 5

[honeydipp]

I'm still having this problem.

Comment 6

[Hallvord R. M. Steen [:hallvors]]

Is anybody still seeing this issue? Works for me on the URLs given in the report and in comments.

Comment 7

[Mike Taylor [:miketaylr]]

Also WFM.