nginx代理服务报Mixed Content: The page at ‘https://xxx.com‘ was loaded over HTTPS

使用nginx代理后端服务时出现如下错误:

Mixed Content: The page at ‘https://xxx.com’ was loaded over HTTPS, but requested an insecure stylesheet ‘http://xxx.com’. This request has been blocked. the content must be served over HTTPS.

错误原因:

nginx代理的https页面中加载的内容使用的http协议导致报错。

解决方法:

在 Nginx 中启用强制 HTTPS 加载资源的 Content-Security-Policy 头。可以在 Nginx 的 HTTPS 配置块中添加如下配置：

增加add_header Content-Security-Policy "upgrade-insecure-requests" 将http协议升级为https。

add_header Content-Security-Policy "upgrade-insecure-requests";

这条指令会告诉浏览器自动将页面中所有通过 HTTP 加载的资源切换为 HTTPS。