I'm trying to make a bookmarklet to use on youtube and other video sites in order to easily get information from the video and store it elsewhere.

From today, apparently I can't do that anymore since youtube force itself on a https connection and from what I've read on chrome's console window, the bookmarklet doesn't run on a https page. Is there a workaround?

Here is the edited code:

javascript:(function(){var jsCode=document.createElement('script');jsCode.setAttribute('src','http://[mysite]/b/enter.php?i=userid&r='+Math.random());document.body.appendChild(jsCode);}());

I'm trying to make a bookmarklet to use on youtube and other video sites in order to easily get information from the video and store it elsewhere.

From today, apparently I can't do that anymore since youtube force itself on a https connection and from what I've read on chrome's console window, the bookmarklet doesn't run on a https page. Is there a workaround?

Here is the edited code:

javascript:(function(){var jsCode=document.createElement('script');jsCode.setAttribute('src','http://[mysite]/b/enter.php?i=userid&r='+Math.random());document.body.appendChild(jsCode);}());

• javascript
• https
• bookmarklet

• Do you see this behavior in browsers besides Google Chrome? Which browsers run the bookmarklet and which do not? – apsillers Commented Jan 16, 2013 at 21:03
• Does you site support https?? – epascarello Commented Jan 16, 2013 at 21:28
• Apparently Chrome blocks it and Firefox not. Unfortunately I don't have a fixed ip so I can't use a SSL certificate. It's just a pet project. If I had users interested maybe I could change that or find another way to easily store youtube links. – maugch Commented Jan 17, 2013 at 18:55
• You can get a SSL certificate from StartSSL for free. – Phil Commented Nov 6, 2013 at 6:51
• Is there any way to tell your browser that you want to (temporarily) allow mixed content? – caponica Commented Apr 1, 2014 at 8:19

4 Answers 4

Google Chrome (and possibly other browsers?) blocks HTTP resources from being accessed from an HTTPS document. This is to prevent "mixed content" attacks, in which insecure HTTP scripts could be intercepted by an attacker in transit over the network and altered to perform any kind of malicious activity (e.g., leak cookies or sensitive page information to a third party). Such a violation would undo any protection granted by HTTPS.

Chrome used to provide a prominent warning that an insecure resource was blocked, but now it no longer does so, and all insecure loads silently fail. The only solution available to you at this time is to use HTTPS yourself when you serve the script.

In Firefox, if you want to run a bookmarklet that references http on an https page, the way to get around this is to temporarily disable security.mixed_content.block_active_content. There are two ways to do this.

1. go to about:config in a new tab, search for security.mixed_content.block_active_content and then toggle the value to false. Run your bookmarklet and then toggle it back to true (since you probably want it turned on most of the time).

2. use an add-on / extension to toggle the block. A quick search turned up Toggle Mixed Active Content, and a quick test seemed to work well. There may be others.

Have fun and be careful. Here be dragons!

the bookmarklet doesn't run on a https page

Why not?

Try changing to a HTTPS domain yourself. Usually HTTP content is blocked when you're on a HTTPS domain.

I have created a work-around "fix" for this issue using a Greasemonkey userscript. You can now have bookmarklets on all CSP and https:// sites, plus have your bookmarklets in a nice, easily-editable library file instead of being individually squished into a bookmark.