I am on a https site and I get a security popup message, “You have mixed content, non-secure items on a secure page”. It looks like removing the inline style: background-image:url('../images/img.png') fixes the problem. Does anyone know why?
<div style="background-image:url('../images/img.png')" />
With Internet Explorer, I wonder if the ‘background-image:url’ uses a different download mechanism.
This is IE7-8.
Here is a related bug from Microsoft but I still can’t find any more details on what is wrong with IE.
Reference:
http://support.microsoft.com/kb/925014
It sounds to me like even though you’re using HTTPS to view the page, IE is trying to load the image referenced in the CSS over an HTTP connection regardless of what the page is actually using (hence the mixing of secure and unsecure content).
Try changing the reference in the CSS to an absolute reference using HTTPS: