Mixed content (HTTP & HTTPS) while loading app #10

enoch85 · 2016-10-30T21:01:30Z

Steps to reproduce

Install the nextcloud-spreedme-snap
Try to reach the app from GUI

Expected behaviour

SpreedMe should be shown

Actual behaviour

Screen is blank (WSOD) and gives me this output with the inspect tool (Chrome)

Mixed Content: The page at 'https://cloud.techandme.se/index.php/apps/spreedme/' was loaded over HTTPS, but requested an insecure resource 'http://cloud.techandme.se/webrtc/'. This request has been blocked; the content must be served over HTTPS.

It's installed with the current VM script that can be found here and works locally but fails with my domain.. I should mention that I'm behind a Nginx Reverse Proxy that sends HTTP to my backends.

The text was updated successfully, but these errors were encountered:

enoch85 · 2016-10-30T21:17:11Z

Also, if I connect directly to the webrtc I get this:

https://cloud.techandme.se/index.php/s/xhYuZRKhjCGoP0y

enoch85 · 2016-10-30T21:22:35Z

Ok progress... If I add const SPREED_WEBRTC_ORIGIN = 'https://cloud.techandme.se'; in the apps config.php I can at least see something, but then it gets another failure:


VM1267:35 Mixed Content: The page at 'https://cloud.techandme.se/index.php/apps/spreedme/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://cloud.techandme.se/webrtc/ws'. This request has been blocked; this endpoint must be available over WSS.

How do I redirect the ws address to HTTPS too? @oparoz

enoch85 · 2016-10-30T23:43:24Z

When running with Opera I get this in the browser log:

jquery-migrate.min.js?v=da1fd1f…:2 JQMIGRATE: Migrate is installed, version 1.4.0
app.js:240 Mixed Content: The page at 'https://cloud.techandme.se/index.php/apps/spreedme/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://cloud.techandme.se/webrtc/ws'. This endpoint should be available via WSS. Insecure access is deprecated.
o.connect @ app.js:240
app.js:240 Connecting to a non-secure WebSocket server from a secure origin is deprecated.
o.connect @ app.js:240
app.js:240 WebSocket connection to 'ws://cloud.techandme.se/webrtc/ws' failed: Error during WebSocket handshake: Unexpected response code: 500
o.connect @ app.js:240
app.js:240 Mixed Content: The page at 'https://cloud.techandme.se/index.php/apps/spreedme/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://cloud.techandme.se/webrtc/ws'. This endpoint should be available via WSS. Insecure access is deprecated.
o.connect @ app.js:240
(anonymous) @ app.js:240
n @ main.js:40
app.js:240 Connecting to a non-secure WebSocket server from a secure origin is deprecated.
o.connect @ app.js:240
(anonymous) @ app.js:240
n @ main.js:40
app.js:240 WebSocket connection to 'ws://cloud.techandme.se/webrtc/ws' failed: Error during WebSocket handshake: Unexpected response code: 500
o.connect @ app.js:240
(anonymous) @ app.js:240
n @ main.js:40
app.js:240 Mixed Content: The page at 'https://cloud.techandme.se/index.php/apps/spreedme/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://cloud.techandme.se/webrtc/ws'. This endpoint should be available via WSS. Insecure access is deprecated.
o.connect @ app.js:240
(anonymous) @ app.js:240
n @ main.js:40
app.js:240 Connecting to a non-secure WebSocket server from a secure origin is deprecated.
o.connect @ app.js:240
(anonymous) @ app.js:240
n @ main.js:40
app.js:240 WebSocket connection to 'ws://cloud.techandme.se/webrtc/ws' failed: Error during WebSocket handshake: Unexpected response code: 500

enoch85 · 2016-10-31T00:39:18Z

Ok another update.... Added this in my NGINX conf

        location /webrtc/ws {
                proxy_pass https://$upstream:443;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }

...and now it works if I allow insecure scripts.

enoch85 · 2016-10-31T00:52:01Z

Ok, strange, now I get this:

{"reqId":"DRXH8LJHOb4ICZQp64um","remoteAddr":"192.168.4.201","app":"index","message":"Exception: {\"Exception\":\"ParseError\",\"Message\":\"syntax error, unexpected 'ff175a99d8906ddbd52f72107e4144' (T_STRING), expecting ',' or ';'\",\"Code\":0,\"Trace\":\"#0 [internal function]: OC\\\\Autoloader->load('OCA\\\\\\\\SpreedME\\\\\\\\Co...')\\n#1 [internal function]: spl_autoload_call('OCA\\\\\\\\SpreedME\\\\\\\\Co...')\\n#2 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/spreedme\\\/helper\\\/helper.php(127): class_exists('\\\\\\\\OCA\\\\\\\\SpreedME\\\\\\\\C...', true)\\n#3 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/spreedme\\\/helper\\\/helper.php(121): OCA\\\\SpreedME\\\\Helper\\\\Helper::doesPhpConfigExist()\\n#4 \\\/var\\\/www\\\/nextcloud\\\/apps\\\/spreedme\\\/controller\\\/pagecontroller.php(29): OCA\\\\SpreedME\\\\Helper\\\\Helper::notifyIfAppNotSetUp()\\n#5 [internal function]: OCA\\\\SpreedME\\\\Controller\\\\PageController->__construct('spreedme', Object(OC\\\\AppFramework\\\\Http\\\\Request), NULL)\\n#6 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Utility\\\/SimpleContainer.php(67): ReflectionClass->newInstanceArgs(Array)\\n#7 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Utility\\\/SimpleContainer.php(84): OC\\\\AppFramework\\\\Utility\\\\SimpleContainer->buildClass(Object(ReflectionClass))\\n#8 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Utility\\\/SimpleContainer.php(105): OC\\\\AppFramework\\\\Utility\\\\SimpleContainer->resolve('OCA\\\\\\\\SpreedME\\\\\\\\Co...')\\n#9 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/App.php(98): OC\\\\AppFramework\\\\Utility\\\\SimpleContainer->query('OCA\\\\\\\\SpreedME\\\\\\\\Co...')\\n#10 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/AppFramework\\\/Routing\\\/RouteActionHandler.php(47): OC\\\\AppFramework\\\\App::main('OCA\\\\\\\\SpreedME\\\\\\\\Co...', 'index', Object(OC\\\\AppFramework\\\\DependencyInjection\\\\DIContainer), Array)\\n#11 [internal function]: OC\\\\AppFramework\\\\Routing\\\\RouteActionHandler->__invoke(Array)\\n#12 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/private\\\/Route\\\/Router.php(293): call_user_func(Object(OC\\\\AppFramework\\\\Routing\\\\RouteActionHandler), Array)\\n#13 \\\/var\\\/www\\\/nextcloud\\\/lib\\\/base.php(983): OC\\\\Route\\\\Router->match('\\\/apps\\\/spreedme\\\/')\\n#14 \\\/var\\\/www\\\/nextcloud\\\/index.php(48): OC::handleRequest()\\n#15 {main}\",\"File\":\"\\\/var\\\/www\\\/nextcloud\\\/apps\\\/spreedme\\\/config\\\/config.php\",\"Line\":28}","level":3,"time":"2016-10-31T01:50:14+01:00","method":"GET","url":"\/index.php\/apps\/spreedme\/","user":"--"}

Same settings as latest post.

enoch85 · 2016-10-31T00:57:20Z

(Removed Spreed Me)

Any ideas?

oparoz · 2016-10-31T03:55:31Z

You cannot use the snap using HTTP only, so I think that the problem here is your reverse proxy.

You also cannot access Spreed.ME directly. You have to use the app within Nextcloud.

enoch85 · 2016-10-31T12:48:00Z

@oparoz I was thinking this is something that could be setup directly in the snap?

I'm trying with the Nextcloud App, but it fails. Though I can reach the WebRTC directly over https...

oparoz · 2016-10-31T15:28:09Z

I was thinking this is something that could be setup directly in the snap?

The snap has been simplified and the HTTPS routines for spreed.ME removed. It's designed to be used with a reverse proxy which handles all SSL requests and connects locally via HTTP.

enoch85 · 2016-10-31T15:30:25Z

Hmm.. this is exactly what my Nginx Reverse Proxy does. How do you use it?

Reported upstream as well --^

oparoz · 2016-10-31T15:46:09Z

How do you use it?

https://github.com/nextcloud/spreedme-snap#1-set-up-your-reverse-proxy

enoch85 · 2016-10-31T16:00:10Z

Got it working again (updated the script a bit) and now I can use it as long as I allow insecure scripts, but I still get this in the browser log:

VM1560:35 Mixed Content: The page at 'https://cloud.techandme.se/index.php/apps/spreedme/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://cloud.techandme.se/webrtc/ws'. This endpoint should be available via WSS. Insecure access is deprecated.WrappedWebSocket @ VM1560:35
VM1560:35 Connecting to a non-secure WebSocket server from a secure origin is deprecated.

Connecting to a non-secure WebSocket server from a secure origin is deprecated. Is there some way to make the socket secure?

enoch85 · 2016-10-31T16:49:08Z

This solved it: nextcloud/vm@cf86ab9

oparoz · 2016-10-31T17:12:01Z

Great. I need to collect a working NGINX config and add it to the readme so that others don't run into the same issue.

enoch85 · 2016-10-31T17:19:06Z

It's easy, just do as I did in this thread. :) The issue was solved by not enforcinig the HTTPS ENV

oparoz · 2016-10-31T17:23:07Z

I'll just use this but enforcing HTTP:
https://github.com/strukturag/spreed-webrtc/blob/master/doc/NGINX.txt

enoch85 · 2016-10-31T17:48:00Z

Yes, that's the Nginx config if you don't run Nginx as a Reverse Proxy, that were the case in this issue.

enoch85 · 2016-10-31T17:48:14Z

@oparoz IRC please :)

ulikoehler · 2020-02-09T06:15:05Z

For everyone who has the same issue: My simple guide on how to fix this:
https://techoverflow.net/2020/02/09/how-to-fix-nextcloud-onlyoffice-mixedcontent-or-refused-to-frame-http-because-it-violates-the-following-content-security-policy-directive-frame-src-https/

TL;DR:
Add

proxy_set_header X-Forwarded-Proto $scheme;

to your nginx location clause.

enoch85 mentioned this issue Oct 31, 2016

Mixed content (HTTP & HTTPS) while loading app (Nextcloud) strukturag/nextcloud-spreedme#56

Closed

enoch85 closed this as completed Oct 31, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Mixed content (HTTP & HTTPS) while loading app #10

Mixed content (HTTP & HTTPS) while loading app #10

enoch85 commented Oct 30, 2016 •

edited

enoch85 commented Oct 30, 2016

enoch85 commented Oct 30, 2016

enoch85 commented Oct 30, 2016

enoch85 commented Oct 31, 2016 •

edited

enoch85 commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016 •

edited

enoch85 commented Oct 31, 2016

enoch85 commented Oct 31, 2016

ulikoehler commented Feb 9, 2020 •

edited

Mixed content (HTTP & HTTPS) while loading app #10

Mixed content (HTTP & HTTPS) while loading app #10

Comments

enoch85 commented Oct 30, 2016 • edited

Steps to reproduce

Expected behaviour

Actual behaviour

enoch85 commented Oct 30, 2016

enoch85 commented Oct 30, 2016

enoch85 commented Oct 30, 2016

enoch85 commented Oct 31, 2016 • edited

enoch85 commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016

enoch85 commented Oct 31, 2016

oparoz commented Oct 31, 2016 • edited

enoch85 commented Oct 31, 2016

enoch85 commented Oct 31, 2016

ulikoehler commented Feb 9, 2020 • edited

enoch85 commented Oct 30, 2016 •

edited

enoch85 commented Oct 31, 2016 •

edited

oparoz commented Oct 31, 2016 •

edited

ulikoehler commented Feb 9, 2020 •

edited