# Webclient "Blocked Insecure Content"

**URL:** <https://forum.servoy.com/t/webclient-blocked-insecure-content/20045>\
**Category:** Classic Servoy\
**Created:** [July 29, 2019, 7:46am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045 "2019-07-29T07:46:45Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![grahamg](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@grahamg](https://forum.servoy.com/u/grahamg)\
**Post date:** [July 29, 2019, 7:46am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/1 "2019-07-29T07:46:45Z")

</div>

Servoy 7.4.x

Have a client concerned at Browser “Content Blocked” warnings when using Print Preview - also appears when using the Forum see screenshot.

Solution is using https and shows as secure but people are understandably reluctant to click on the “Load unsafe Scripts” option.

Could not find anything previously on the Forum and welcome suggestions on how others are handling this.

Thanks

 ![Screenshot 2019-07-29 at 08.31.47.png](https://canada1.discourse-cdn.com/flex010/uploads/servoy/original/2X/4/48aec755906f7666d26d4a9d509d574a92c6d753.png)

---

<div class="post-metadata">

**Author:** ![mboegem](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/mboegem/32/4399_2.png) [@mboegem](https://forum.servoy.com/u/mboegem)\
**Post date:** [July 29, 2019, 9:13am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/2 "2019-07-29T09:13:03Z")

</div>

Hi Graham,

your customer is getting these warnings, because at that point a page is loaded with scripts that, most likely, use unsafe http connections.  
The main page might be secured with a certificate, but scripts could load content over unsafe http connection.

In order to find the source of these messages: open the inspector in Chrome, navigate to the ‘Network’ tab and then see which resources are (trying to be) loaded over http. (They probably appear in red)

This problem might even be some script outside of your application as it can be a Chrome extension that injects a script in each page, which then is trying to load other resources over http.  
Try the inspector and you’ll find out very soon ![:-)]( "Smile")

Hope this helps

---

<div class="post-metadata">

**Author:** ![grahamg](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@grahamg](https://forum.servoy.com/u/grahamg)\
**Post date:** [July 29, 2019, 9:33pm UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/3 "2019-07-29T21:33:21Z")

</div>

Thanks Marc - great advice from you as always ![:)]( "Smile")

> Mixed Content: The page at ‘[https://xxxx.worxinfo.com/servoy-webclient/application/s/sdlt.3.1](https://xxxx.worxinfo.com/servoy-webclient/application/s/sdlt.3.1)’ was loaded over HTTPS, but requested an insecure resource ‘[http://xxxx.worxinfo.com/servoy-webclient/resources/servoy/resources](http://xxxx.worxinfo.com/servoy-webclient/resources/servoy/resources)’. This request has been blocked; the content must be served over HTTPS.

However, I’m not sure how to resolve this as the offending function is simply to [Print Preview] - all code & forms are on the Servoy Server - but there is a “http://…/servoy-webclient/resources/servoy/resources” call that I presume is made internally by Servoy?

Does anyone know how to change the ‘http://…’ call to 'https://…"?

Thanks  
Graham

---

<div class="post-metadata">

**Author:** ![rmcneilly](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@rmcneilly](https://forum.servoy.com/u/rmcneilly)\
**Post date:** [February 7, 2020, 4:35am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/4 "2020-02-07T04:35:32Z")

</div>

Hello Graham,  
Were you able to solve this issue?  
A common thread seems to be that there’s usually a proxy involved. Maybe a transparent one.

Regards,  
Richard.

---

<div class="post-metadata">

**Author:** ![grahamg](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@grahamg](https://forum.servoy.com/u/grahamg)\
**Post date:** [February 8, 2020, 2:54pm UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/5 "2020-02-08T14:54:25Z")

</div>

Hi Richard

Short answer - No.

The offending ‘http’ calls are generated by Servoy so no control over them. I reverted to generating the PDF’s and saving in a docs table with button for Users to download. A few extra clicks but not really a big deal.

Graham

---

<div class="post-metadata">

**Author:** ![Harjo](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/harjo/32/4873_2.png) [@Harjo](https://forum.servoy.com/u/Harjo)\
**Post date:** [February 10, 2020, 8:16am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/6 "2020-02-10T08:16:42Z")

</div>

Dd you file a bug report?  
Because I think that is bug in Servoy!

---

<div class="post-metadata">

**Author:** ![jcompagner](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/jcompagner/32/4889_2.png) [@jcompagner](https://forum.servoy.com/u/jcompagner)\
**Post date:** [February 11, 2020, 1:34pm UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/7 "2020-02-11T13:34:49Z")

</div>

the server is behind a proxy?  
so the https (tls/ssl) is handled by something else?

Then servoy doesnt directly know what it should do if we need to generate a full url. The proxy has to set certain stuff like X-Forwarded-Scheme or Forwarded where the scheme is a part of.

That we we know that we need to generate a https url instead of http.

---

<div class="post-metadata">

**Author:** ![grahamg](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@grahamg](https://forum.servoy.com/u/grahamg)\
**Post date:** [February 16, 2020, 11:49am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/8 "2020-02-16T11:49:06Z")

</div>

Hi Johan

It’s a WebClient-only system on one of Harjo’s Servers - he is better placed than me to describe how the setup might interact with Servoy.

Given the move of all Browsers towards requiring https would it be better if Servoy now defaulted to this? I would not have thought there were many circumstances that required a non-secure connection.

---

<div class="post-metadata">

**Author:** ![jcompagner](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/jcompagner/32/4889_2.png) [@jcompagner](https://forum.servoy.com/u/jcompagner)\
**Post date:** [February 17, 2020, 8:13am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/9 "2020-02-17T08:13:03Z")

</div>

we can’t default to this  
the proxy/firewall before a servoy tomcat must give this information to us.  
But besides that we also have a setting on the admin page “servoy.X-Forwarded-Proto” that can set this info

---

<div class="post-metadata">

**Author:** ![grahamg](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@grahamg](https://forum.servoy.com/u/grahamg)\
**Post date:** [February 17, 2020, 9:23am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/10 "2020-02-17T09:23:45Z")

</div>

> But besides that we also have a setting on the admin page “servoy.X-Forwarded-Proto” that can set this info

Maybe I need another coffee - but can’t see this on Admin or Network Settings. Is this to keep it out of the hands of people who might be dangerous using it ![:D]( "Very Happy")

---

<div class="post-metadata">

**Author:** ![jcompagner](https://yyz2.discourse-cdn.com/flex010/user_avatar/forum.servoy.com/jcompagner/32/4889_2.png) [@jcompagner](https://forum.servoy.com/u/jcompagner)\
**Post date:** [February 17, 2020, 10:00am UTC](https://forum.servoy.com/t/webclient-blocked-insecure-content/20045/11 "2020-02-17T10:00:17Z")

</div>

no because you are on a very old version of Servoy…
