security - How To Tell What Files IE Thinks Are "nonsecure"?

Question

We have a CMS system whose web interface gets served over HTTPS. This works beautifully for Firefox, but when we load it in IE6 or IE7, it complains that "This page contains both secure and nonsecure items."

I've loaded the page in Firefox and checked with Firebug, and every connection seems to be going through HTTPS, as should be the case.

Is there any way to tell what is causing IE to throw this apparently spurious error?

Answer 1

Firefox has a number of bugs in mixed content detection. Generally you should try using Fiddler to spot insecure resources.

If you install a tool I wrote (www.bayden.com/dl/scriptfreesetup.exe) you will get a different mixed content prompt which shows the exact URL of the first insecure resource on the page. That tool is basically a prototype and you should uninstall it when you're done with it.