Chrome will soon block sites that mix HTTP and HTTPS (possibly including some favorites)

[ENTERPRISE]

For security, fantastic for ease of site integrations, this can be problematic as you would need to ensure all your site integrations are pulling data from other HTTPS domains. That being said, all sites should be on HTTPS in this day and age.

 

Having already introduced warnings in Chrome that let you know when you're visiting a non-secure website – that is, HTTP rather than HTTPS – Google is taking things further and is planning to start blocking ‘mixed content’.

 

In future versions of Chrome, Google will block HTTP content that is loaded by encrypted HTTPS sites. The company is taking steps to address the problem of secure sites that pull in content – such as scripts, media files and iframes – that are not secure. It calls this mixed content.

 

The reason for wanting to lock this down further is that HTTP content can be interfered with. This means that an incorrect image could be displayed, or a malicious script could be run in the background.

 

As it has done with previous changes, the new security feature is going to rolled out gradually. Starting with Chrome 79, which is due to moved from development and beta testing channels for a mainstream release in December, Google will start to completely block mixed content.

 

 

Source: https://www.techradar.com/uk/news/chrome-will-soon-block-sites-that-mix-http-and-https-which-could-include-some-favorites

[Andrew]

Well, that's good. It's been known for a while now that most "viruses" come from dodgy adverts these days. It's a shame Google has to force websites to upgrade their entire website to https rather than them just doing it themselves.

[ENTERPRISE]

Yeah, ideally website owners should have been taking responsibility a good while ago with HTTPS. Some of the challenge however are websites that host content from pre-HTTPS era which will cause the mixed content which will cause linking and content breakages.