17

Since Stack Overflow is in HTTPS, I suppose a lot of snippets are not working anymore and returning a "Mixed Content" error.

I have this issue with one of my answers: Skipping null values with Morris.js.

The snippet is working with Firefox 56.0.1 but returns an error in Chrome 61.0.3163.100 and Edge 40.15063.674.0.

Chrome Error:

Mixed Content: The page at '[...]' was loaded over HTTPS, but requested an insecure script '[...]'. This request has been blocked; the content must be served over HTTPS.

Edge Error:

SEC7111: HTTPS security is compromised by [...]

The problem is that I can't find an HTTPS version of the library I use; an old release of Morris.js:
Morris.js version 0.4.3

So I tried, like suggested in SOCVR, to include directly a minified version of the script inside the snippet, but got blocked by the characters limitation:

Body is limited to 30000 characters; you entered 33592.

So my questions is:

  • How can I make a working snippet with a library not available in HTTPS?

If there's no workaround currently, is there something scheduled to resolve this issue like:

  • More libraries available for code snippets
  • Upload libraries somewhere (with some kind of validation)
7
  • I've seen a lot of jsfiddle links, and a few codepen links, in JS questions and answers --- is there any guidance on when to use snippets and when to use such external services?
    – cxw
    Commented Oct 13, 2017 at 14:52
  • 7
    Does this not work? Commented Oct 13, 2017 at 14:55
  • 2
    @dylmye: Oh yes! That should work. Thank you. I didn't know you could change the version. I searched Morris and viewed only the version 0.5.1.
    – krlzlx
    Commented Oct 13, 2017 at 14:59
  • 1
    @cxw: Personally, I like the snippet because you can run the code directly without leaving the page. With JSFiddle and CodePen on the other hand, you can edit the code.
    – krlzlx
    Commented Oct 13, 2017 at 15:07
  • 1
    @cxw There could be many reasons for which one might want to use alternatives such as JS fiddle. For instance, window.open is not allowed in stack snippets - due to sandboxing I guess, but JS fiddle does allow it. So you'd need to use an alternative for a question about window.open. Commented Oct 13, 2017 at 15:11
  • 4
    @cxw, While it's permissible to also have a JSFiddle, or other off-site runnable version of the code, it is much preferred that such be on-site. Keep in mind that while they might also have an off-site version, all information necessary to answer the question must be in the question itself. Debugging questions also have the explicit requirement that a MCVE be contained in the question. While there are cases where it's not possible to use a snippet due to various technical issues, doing so, when possible, is certainly preferable.
    – Makyen Mod
    Commented Oct 13, 2017 at 15:59
  • @dylmye You could add an answer describing how to get a specific version of a library with cdnjs.
    – krlzlx
    Commented Oct 14, 2017 at 20:31

1 Answer 1

22

The best solution is to find an HTTPS based source for the file you desire to use.

Files in GitHub repositories are always available via HTTPS

Older RawGit URLs

This answer used to only describe how to use RawGit to serve GitHub files via HTTPS. Unfortunately, RawGit is going away.

Converting existing RawGit URLs to jsDelivr:

jsDeliver has a converter from RawGit URLs to jsDelivr.

Old directions for getting a RawGit URL for a GitHub File

You can use RawGit to obtain a file within a GitHub repository via HTTPS.

For Morris.js, version 0.4.3, you can go to the repository; then switch to the tag for the 0.4.3 release; then get the URL for the file you desire and enter it into the RawGit page. That page will then display an appropriate HTTPS based URL for you to use.

Screen movie of GitHub switching to a repository tag, then using RawGit to identify the URL for a specific file

5
  • Nice! Thank you for your answer. What about libraries that are not on GitHub or not available anywhere in HTTPS? Can we upload a library on our personal GitHub and use the method you described or is it not recommanded (licence)?
    – krlzlx
    Commented Oct 14, 2017 at 20:26
  • @krlzlx, Copying is something that you would need to determine based on the license under which it was published. However, it'd be unusual for code to be published with the intent of being a general purpose library under a license which doesn't permit you to host the library on some other service. Given that it's a legal issue (which varies by jurisdiction), and the base default is that you don't have the right to copy (anything, at least in the USA), I can't just make a recommendation that you do so. The only recommendation I can make along those lines is to check the license.
    – Makyen Mod
    Commented Oct 14, 2017 at 20:34
  • So what would you do if you can't find an HTTPS version of a library to make a working snippet?
    – krlzlx
    Commented Oct 14, 2017 at 20:38
  • 1
    @krlzlx ... Wait what? So You wanna use the non-HTTPS "library" in Your final project..? :-)
    – Skipper
    Commented Oct 16, 2017 at 9:28
  • @Skipper No! I'm asking what can be done if the library cannot be found in HTTPS. What is the best solution to make it available in HTTPS?
    – krlzlx
    Commented Oct 16, 2017 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .