When using SSL be sure it's all SSL

Recently I deployed a site for an online shop that had a check out system that needed to be under SSL. We tested with sample certificates and all seemed to work as required. We then deployed and there was an issue. It was not with Chrome or Firefox but with everyones favourite browser IE. IE kept showing customers the 'Do you want to downlaod all content' message as it thought something was at risk. To make matters a bit more confusing all JSON requests were causing IE to open an application to view them. I mistakely thought this was something only to do with the JSON requests.

The first step was to fix the JSON request issue that was only showing up on IE. The simplest fix was to ensure he ContentType parameter was set for all JSON returns. The following snippet shows this by adding in the "text/html" ContentType parameter to the end of the return call:

return Json(new { success = true, message = "Success"}, "text/html");

This fixed the first issue of IE trying to run an application each time a JSON response was returned. But this did not solve the 'Do you want to downlaod all content' message for the rest of the page. I then fired up the developer tool that comes in IE 11 and traced the page as it loaded. A great tool to have I must add. If found straight away that a Javascript library I was including from Sharethis was not under SSL. One of the security requirements of SSL is that all included libraries, especially those from a seperate domain must also be under SSL. To fix this I changed my Sharethis lazy loading include to:

var switchTo5x = true;
function loadShareThisScript() {
var script = document.createElement("script");
script.type = "text/javascript";
script.src = (document.location.protocol == 'https:') ? "https://ws.sharethis.com/button/buttons.js" : "http://w.sharethis.com/button/buttons.js";
document.body.appendChild(script);
}

This now checked the protocol of the page and loaded the correct library for SSL. IE was now happy again.