0

I am trying to consume a REST API that the protocol is HTTP, no HTTPS. But, as Sharepoint Online uses protocol HTTPS, I am getting this error:

Mixed Content: The page at 'https://integralinf.sharepoint.com/sites/guilherme.nass/fischer/SitePages/P%C3%A1gina%20Inicial.aspx' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://api.promasters.net.br/cotacao/v1/valores/'. This request has been blocked; the content must be served over HTTPS.

My code is:

$(document).ready(function() {
    $.ajax({
        method: 'get',
        url: 'http://api.promasters.net.br/cotacao/v1/valores/',
        success: function(data){  
            console.log(data);
        },
        error: function(err) { 
            console.log(err);
        }
    });
});

I can't change the REST API to uses HTTPS, because it's not my API, it is only an API that I found.

Is there any solution for this? I really need to use this API.

  • Have you confirmed that the URL will not work with https? Type the URL into a browser with https and see if it works. – Mike Smith - MCT - MVP Feb 23 '18 at 0:01
  • Hi Mike, Yes, I already tried it. The return is 404 Not Found. – Guilherme Nass Feb 23 '18 at 3:50
6

I created a small example for you to use.

This example forwards your request to the requested endpoint http://api.promasters.net.br/cotacao/v1/valores/

If you pass which resource you want to reach to the proxy it will give you the same response.

https://sharepintdemo2.azurewebsites.net/valores/

Here is a description of how to do it. First create an Azure Function App. Call it what ever you want. Probably something with your company name.

Second, create a new Proxy.

enter image description here

Third, fill in your settings.

enter image description here

By entering a route template you can forward the passed parameters to the Backend URL.

And voila!

enter image description here

1

You will be required to use an https endpoint for your Rest API. The mixed content issue is well known, and any attempts to circumvent are just BAD practice (And a waste of time).

Actions to resolve your issue:-

  • Setup a very basic Rest API that you control, that acts as a simple proxy to the API that you require. Basically you call the3rd Party API from you API. Then inside sharepoint call your API

  • Approach the vendor and explain to them your situation. Any vendor in this space that wishes to be taken seriously should be able to provide a HTTPS endpoint so as not to isolate potential consumers of it.

Ultimately this is by design. And it is a good design because it collectively increases the security of the web and it users.

0

The reason that we don't serve content via a HTTP endpoint is quite simple. You would be passing an authentication cookie to the server, and we wont allow you to do that, since others could intercept it on an insecure channel and that would allow them to hijack your session.

So the simple solution is to switch to HTTPS, since you even said the snippet is your code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.