Showing posts with label internet explorer. Show all posts
Showing posts with label internet explorer. Show all posts

Friday, August 30, 2013

Mixed Content: What Instructors and Instructional Designers Need to Know

The Big Three Block Mixed Content: Update Your HTML

by Alan Regan

In August, Mozilla released Firefox 23. Firefox is a major web browser and it created a serious ripple, especially throughout higher education. With the release of Firefox 23, the browser now blocks "mixed content." This means that some information on web pages will not be displayed, such as embedded media or linked CSS formatting that points to unsecured sources.

However, Firefox is not the only browser that does this. Internet Explorer has blocked mixed content since IE 8 (2009) and Chrome started blocking mixed content in version 21 (2012).

What is "mixed content"?

Mixed content refers to a web page that contains a mix of both secure content and open or unsecured content. Basically, you're visiting a secure web page (the address begins with HTTPS and has a current and valid security certificate installed). On that secure web page, there is content that draws from an open or unsecured source.

Example pages

For the following examples, please use one of the following web browsers: Firefox 23+, Google Chrome 21+, or Internet Explorer 8+. Do not use Apple's Safari web browser, since as of the writing of this blog, it does not block mixed content. Not yet, at least.
  • Secure Content Example. See this example web page that is hosted on a secure website and only refers to secured content. All references point to content with valid HTTPS addresses.  You should see an embedded YouTube video as well as a dynamic countdown counter.
  • Mixed Content Example. See this example web page that is hosted on a secure website but refers to media and code with unsecure references. The references point to content with HTTP addresses. The same objects as above are included, but you will likely not see the objects due to mixed content blocking.

What You Need to Verify or Change in Your Code

If you are embedding content on our learning management system or any secured website, check your code. You want to be sure that all LINK, SCRIPT, SRC, and VALUE references point to HTTPS sites. You also want to be sure that the target websites have valid SSL certificates installed.

If your code contains value="http://www.youtube.com/v/1skBWSln_j4?version=3&hl=en_US&rel=0"

... you would change the code to value="https://www.youtube.com/v/1skBWSln_j4?version=3&hl=en_US&rel=0"

Another technique to explore is to remove the "scheme" from the address altogether. The scheme is http: or https:.  An example would be like this: value="//www.youtube.com/v/1skBWSln_j4?version=3&hl=en_US&rel=0"

Finally, you can also consider relative references. "Absolute" references include the complete address for a given resource. "Relative" references provide the path to the resource based on the source web site address.
  • Absolute reference: <img src="http://www.pepperdine.edu/images/home/vista-3.jpg" /> 
  • Relative reference: <img src="/images/home/vista-3.jpg" />

Be sure to check:
  • Media embed code
  • Image references
  • Linked Javascript or other script files
  • Links within Javascript or other script files
  • Linked stylesheets (CSS)
  • Links within stylesheets (CSS)

Embed Site to Avoid: TED.com

As of this writing, the TED.com website does not offer HTTPS references for its videos. If you would like to embed TED Talk content, find the same video on YouTube and use YouTube's embed code which supports HTTPS.

The Tempting-But-Not-Advised Approach

While I can understand the motivation, I would discourage you from simply asking your site participants to use the Safari web browser. Granted, Safari seems to display mixed content right now, but that can easily change. An equally bad practice is to ask your visitors to permanently set their web browsers to "allow" mixed mode content. These two approaches seem like easy fixes because you don't need to do anything to your content. However, the reason that your content isn't displaying in other web browsers is because you are not following the best practices to help protect your audience. Please put in the time to review your code and update your references as needed. This way, your participants can easily view your content and feel secure doing so!

Resources:

Related Posts:

Posted by at

Monday, August 26, 2013

Help! Firefox Ate TED! Why videos and websites may not appear in some browsers

My Video Disappeared!

Learn why Firefox 23 or IE 10 may be blocking your content

by Alan Regan

Not seeing an embedded video, image, or web page?  If you're using Firefox 23+ or Internet Explorer 10+, then this is because you're suffering from the "mixed content" blues.

Released in early August, Firefox 23 has a new security feature. It's called "mixed content blocking." The short description: if you are on a secure website (like Courses/Sakai, WaveNet, Digication, and almost every website that requires a login) and the page tries to load content from an outside website that is not a secure website, then the browser will block that content from appearing.  Another way to look at it is if you are on a website and the address begins with HTTPS and you're embedding content and the code references website addresses that begin with HTTP and not HTTPS, then you need to put in some fixes so that your audience sees the content.

So, what can you do?  First, you need to look at your class sites and see if any of your content is being blocked.  Open up your class site or website in Firefox 23 and see if the material loads.  If the page is blank -- then you need to correct the code or re-embed the content for a secure address.

Thankfully, YouTube makes it pretty easy now.  The latest embed code takes out the guesswork and helps professors, students, and everyday users embed with ease. Of course, this new YouTube code started mid-June 2013. So, if you embedded a YouTube video before that time, you need to go back, remove the old YouTube code, and embed the new code.

A ray of sunshine is that our new Sakai 2.9 service now supports the shorter "iframe" embed code! It's currently supported in Forums, Syllabus, and Lessons. (The Home tool does not support iframe yet, but we hope to correct this soon!) This should make the process of re-embedding videos a little easier than in the past. Also, with the new iframe code, mobile participants should be able to play the video.

  1. Visit http://www.youtube.com
  2. Find your video.
  3. Below the video, click Share and then click Embed.
  4. We recommend that you uncheck the box "Show suggested videos when the video finishes." This will prevent potentially unwanted or inappropriate video recommendations from displaying at the end.
  5. Copy the code.
  6. Go to your class site on http://courses.pepperdine.edu
  7. Go to a supported tool like Forums, Lessons, or Syllabus (if a tool is not in the menu, use Site Info > Edit Tools to add it).
  8. In the rich text editor, click Source at the top left.
  9. Paste the YouTube embed code.
  10. Click Source again and then finish the posting.
  11. Your embedded video should display fine in all browsers and also on most tablets and smart phones.
NOTE: On the Home tool you will still need to check the box "Use old embed code" when copying code from YouTube. Again, you can use the newer iframe code with Forums, Lessons, and Syllabus.

There is a known issue with videos from the TED.com website, though.  This isn't an issue with the web browser or Sakai, WaveNet, etc.  The issue is squarely on the TED.com website.  As of this moment, the TED.com website is not a secure website.  If you link to a video, it only supports an HTTP connection and not an HTTPS connection.  The solution?  For the most part, almost every TED.com video can be found on YouTube.  Embed the video located on YouTube and you should be fine.

You may be asking, "Well, what if I don't use Firefox or Internet Explorer?" That's fine, but know that this security setting may soon be coming to your other web browsers like Chrome and Safari.  Web security is important, so don't rely on "use another web browser" as a fix.  Best practice is to embed content from a secure source when you're on a secure website.

So, now you know why some content may appear for some visitors, but not for others.  The likely culprit is "mixed content" blocking on some web browsers.  You also know the fix: update your web links or embed code to secure versions. We hope this helps you create better online experiences for your audiences!

Learn more:


Posted by at
Subscribe to: Posts (Atom)