网站部署https后,浏览器提示不安全, 不出现绿色小锁图标?
访问网站后,按f12,浏览器提示:
mixed content: the page at 'https://www.xxx.com/'' was loaded over https, but requested an insecure image 'http://www.xxx.com/uploads/2018/12/3.png'. this content
原因是在https页面中，如果调用了http资源，这样的话浏览器就会抛出一些错误,
解决方案:在header中加入upgrade-insecure-requests,会告诉浏览器可以把所属本站的所有http连接升级为https连接,外站请求保持默认;
添加header方法:
1.iis7
或直接在网站根目录web.config中定义
<?xmlversion=1.0encoding=utf-8?><configuration><system.webserver><httpprotocol><customheaders><addname=content-security-policyvalue=upgrade-insecure-requests/></customheaders></httpprotocol></system.webserver></configuration>2.apache
可直接在网站根目录.htaccess中定义
<ifmodulemod,headers.c>headeraddcontent-security-policyupgrade-insecure-requests</ifmodule>3. nginx
server{listen80;server,name(myservername);add,headercontent-security-policyupgrade-insecure-requests;location/{proxy,passhttp://localhost:5000;}}