We have a provider hosted app that needs the SharePoint javascript and CSS files, so in our MVC view we added the following code:

<script src="@Request.QueryString["SPHostUrl"]/_layouts/15/SP.RequestExecutor.js" type="text/javascript"></script>
<script src="@Request.QueryString["SPHostUrl"]/_layouts/15/sp.js" type="text/javascript"></script>

The provider hosted app runs in HTTPS, our SharePoint environment in HTTP.

The app wants to get those SharePoint javascript and CSS files, but blocked because you try to access files from HTTPS to HTTP.

Example of an error in IE:

SEC7111: HTTPS security is compromised by http://ap/project/blabla/_layouts/15/sp.ui.controls.js

Example of an error in Chrome:

[blocked] The page at 'https://ap:2281/Appname/?SPHostUrl=…' was loaded over HTTPS, but ran insecure content from 'http://ap/project/blabla/_layouts/15/sp.ui.controls.js': this content should also be loaded over HTTPS.

How can we solve this issue without setting our SharePoint environment also to HTTPS?

  • 1
    I think IE has a setting you can set to allow mixed content. Not sure if this is the same thing or not. – wjervis Aug 20 '14 at 12:18
  • Yes, there's a setting for it. But then everybody who wants to use the app must change his browser settings. And that's not really customer friendly – Davy Aug 20 '14 at 13:02
  • No, it's not. You can download the js file to your app. Not sure if that's an advisable solution, however. – wjervis Aug 20 '14 at 13:23
  • Goto setting of your browser >> advance setting>> allow mixed content >>enable – user27178 Oct 19 '15 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.