Home/ Questions/Q 4339140
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T11:10:36+00:00

I’m not 100% sure that I’m using the correct terminology or if I’m leaving

  • 0

I’m not 100% sure that I’m using the correct terminology or if I’m leaving out information that is required to answer. So please be patient with me.

My client wants to include a video feed from an outside source inside a members area of their website. The members area is delivered over https and the video feed is not. Does this compromise the secure data?

I know that some browsers alert the user that there are secure and non-secure data being loaded on the page. Frankly, my client is okay with that, but I don’t want to move forward if the user account information (specifically, session, etc.) is compromised.

Thanks for any help.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If your pages references unencrypted Javascript or Flash, you’re totally unprotected; an attacker can substitute any Javascript he wants, and can steal non-HTTP-only cookies, or make arbitrary HTTP requests that impersonate the current user.

    If you reference unencrypted CSS, you’re still vulnerable; attackers can arbitrarily modify your layout, and can execute arbitrary code in IE and Firefox.

    If you reference unencrypted images, you’re mostly fine; all the attacker can do is see the Referer header and find out what page the user is seeing. (He’ll also get any non-SSL-only cookies for the image’s domain).
    The attacker can also alter the images to suit his needs, which may be a concern.

    • 0