0

How can I force a js library to always load only via SSL?

Specifically, I want to get Drupal to always load stripe.js with SSL, because stripe.js refuses to load over http (you get a 403 FORBIDDEN error).

I'm loading stripe.js through the Commerce Stripe module.

commerce_stripe.libraries.yml looks like this:

stripe:
  remote: https://github.com/stripe/stripe-php
  version: "4.3.0"
  license:
    name: MIT
    url: https://github.com/stripe/stripe-php/blob/master/LICENSE
    gpl-compatible: true
  js:
    "https://js.stripe.com/v3/": { minified: true }

So I thought this would be sufficient to always load via SSL.

On my production site, for which all the assets are SSL, everything works.

On Lando, my local development environment, everything is fine when I access my site from a browser installed on my machine, even when the connection to the locally hosted website is http (connection to my dev site is http, connection to stripe.js is https).

However, when using the Standalone Chrome Debug docker image to test my site with Behat, stripe.js doesn't load. I get a 403 FORBIDDEN error because the Chrome browser in the Standalone Chrome Debug container tries to load stripe.js via http.

From the Chrome browser with the problem, this is what the <script> tag looks like for stripe.js:

<script src="//js.stripe.com/v3/"></script>

I'm not sure exactly why I am having this problem only with the Standalone Chrome Debug docker image, but I suspect it is because I cannot access my site via https from the image at all. However, in the browser, I can open other SSL sites such as https://www.google.com and perform a search without any problems.

So,

  • If I am accessing a local installation of Drupal via docker from inside a docker container
  • And I do not have access to the Drupal installation via HTTPS
  • Is it impossible to load a third-party js library (stripe.js) via HTTPS?

The reason I'm confused is that I can load stripe.js locally when accessing my site via a browser in Windows (my dev machine) through http, but in the Docker container (standalone-chrome-debug), accessing my local dev site through http gets a 403 forbidden for stripe.js. (When I manually type the stripe.js library link into the browser, I can download the library, so the problem only occurs with the link/connection generated by Drupal.)

Improve this question
4
  • 2
    You don't load a JS using HTTPS (or any other resource), you use HTTPS for all web resources. In fact, if you load any resource with HTTP in a HTTPS web the whole page is considered unsecure. In your case, the problem is probably you don't have HTTPS in the "Standalone Chrome Debug docker image". I guess your question should how to have HTTPS when using a "Standalone Chrome Debug docker image". In that case, you should ask it in Stackoverflow.
    – sanzante
    Sep 12, 2020 at 11:08
  • @sanzante Ok, thank you for the clarification. I updated my question to specifically ask what is the requirement to get third-party resources via HTTPS in Drupal.
    – Patrick Kenny
    Sep 12, 2020 at 11:38
  • 1
    That's a protocol relative include, meaning it will take the current protocol and use that. If you access via http, that's what you would get. Is the site being tested under https? Is something removing the protocols (advagg?)?
    – Kevin
    Sep 12, 2020 at 12:22
  • @Kevin Toggling advagg on and off "fixed" this issue. It may not be the definitive answer, but for testing it's good enough for now, so if you add that as an answer I will accept.
    – Patrick Kenny
    Sep 12, 2020 at 13:01

1 Answer 1

Reset to default
2

That's a protocol relative include, meaning it will take the current protocol and use that. If you access via http, that's what you would get. Is the site being tested under https? Is something removing the protocols (advagg?)?

Modules like advanced aggregation have settings to remove protocol and make all links protocol relative. Disable settings like that and run the tests again.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.