Question

I’m trying to embed an Amazon "Recommended Product" widget into a website. We use SSL across all pages on the site.

Unfortunately, the Amazon widget by default is embedded using a simple IFrame and although the source for the IFrame can be https://, the images and links within the IFrame are always http://

IFrame sample code

<iframe src="https://rcm-uk.amazon.co.uk/e/cm?t=june2k&o=2&p=16&l=st1&mode=books-uk&search=potter&f=ifr&f=ifr"
        width="468"
        height="336"
        border="0"
        frameborder="0"
        style="border:none"
        marginwidth="0"
        marginheight="0"
        scrolling="no"></iframe>

Needless to say this results in "insecure content" warnings, broken padlocks, etc.

So far the only solution I’ve been able to come up with is to get the contents of the IFrame using the server, parse it and re-write all the image links to point at a local handler which in turn proxies the images. It seems like a fragile approach with a lot of processing overhead. It’s just nasty.

Does anyone have any experience with this? Is there a method here that I’m missing? Can I get Amazon to return valid https:// urls?

If I change the image urls from http to https in-situ, I get a certificate mis-match error – it seems the images are served from the Akamai CDN and the common name for the certificate isn’t the hostname used to serve the images.

Answer 1

After a lot of digging, I found a version of the widget on the Amazon site which ran in SSL mode without errors.

After looking at the IFrame src, the URL has an additional parameter internal=1. I haven’t seen this documented anywhere but it seems to tell the widget to serve the images from Amazon’s network instead of Akamai’s, and SSL is supported.

The url should look like this:

https://rcm-uk.amazon.co.uk/e/cm?t=june2k&o=2&p=16&l=st1&mode=books-uk&search=potter&f=ifr&f=ifr&internal=1