Can't link to my own images any more

[Joe Horn]

I used to be able to link directly to images on my server, but recently that stopped working, like this:



The IMG tag above includes this link: http://holyjoe.net/Prime/Pix/PrimeMerryXmas2020.png

Even the images in my existing postings, which displayed perfectly before, have all stopped being displayed. Anybody know what changed? If it matters, my server uses HTTP, not HTTPS, because my site doesn't contain anything that needs a security certificate.

[rprosperi]

I can see the embedded image you posted just fine...

...looks the same as the image in the link

[trojdor]

Joe,
It's the recent changes to the security settings in Google Chrome.
Other browsers seem to work fine, but I have to enable the 'allow insecure site settings' option for MoHPC in order for chrome to show the images.

(You get to the individual site's settings by clicking on the padlock to the left of the URL.)

Chrome has gotten very nervous if all the page content doesn't come from the same HTTPS URL .... thus the 'insecure' rating.


mike

[Gene]

can confirm. Works once that setting was changed.

[Joe Horn]

AHA! Thanks, trojdor and Gene! Changing that setting in my browser fixed the problem!

[grsbanks]

(01-05-2021 12:06 AM)trojdor Wrote:  Chrome has gotten very nervous if all the page content doesn't come from the same HTTPS URL .... thus the 'insecure' rating.

Not necessarily from the same url but certainly served over HTTPS protocol.

While nothing on your server may need SSL, Joe, it's a good idea to implement it anyway. This particular action of Chrome has been patially implemented for a long time. Maybe not extended to images until now but certainly javascript loaded from an http link on an https page has set off alarm bells for a long time. Also, non-ssl websockets.

[ijabbott]

(01-05-2021 10:50 AM)grsbanks Wrote:  

(01-05-2021 12:06 AM)trojdor Wrote:  Chrome has gotten very nervous if all the page content doesn't come from the same HTTPS URL .... thus the 'insecure' rating.

Not necessarily from the same url but certainly served over HTTPS protocol.

While nothing on your server may need SSL, Joe, it's a good idea to implement it anyway. This particular action of Chrome has been patially implemented for a long time. Maybe not extended to images until now but certainly javascript loaded from an http link on an https page has set off alarm bells for a long time. Also, non-ssl websockets.

Since Joe is using dreamhost.com, these guides may come in handy:

Adding an SSL certificate overview
Adding a free Let's Encrypt certificate