Currently the CSS gets built and then cached with either HTTP or HTTPS URLS, depending on which you are on when it's cached. If you switch to the other after the cache is built, you'll get a mixed content warning, as mentioned here:

http://drupal.org/node/1176100#comment-5928080

Comments

BarisW’s picture

BarisW commented
Status: Active » Closed (cannot reproduce)

I've tried reproducing this, but I cannot.

- I enabled some Google Fonts and enabled CSS compression.
- On the http version of my site, the call to the Google CSS is http://fonts.googleapis.com/css?family=Abel:regular&subset=latin
- When I switch to https, the call is changed to https://fonts.googleapis.com/css?family=Abel:regular&subset=latin

The contents of the CSS files on Google's server changes accordingly to the protocol.
So in the http version, it's 

@font-face {
  font-family: 'Abel';
  font-style: normal;
  font-weight: normal;
  src: local('Abel'), local('Abel-Regular'), url('http://themes.googleusercontent.com/static/fonts/abel/v3/wnJbeWILdr-ZMJJAMsiXsvesZW2xOQ-xsNqO47m55DA.woff') format('woff');
}

and in the https version, it's:

@font-face {
  font-family: 'Abel';
  font-style: normal;
  font-weight: normal;
  src: local('Abel'), local('Abel-Regular'), url('https://themes.googleusercontent.com/static/fonts/abel/v3/wnJbeWILdr-ZMJJAMsiXsvesZW2xOQ-xsNqO47m55DA.woff') format('woff');
}

I also enable the Secure Pages module to see if this makes any difference, and it does not.
Marking this closed until someone is able to explain how to reproduce this.

sreynen’s picture

sreynen commented
Status: Closed (cannot reproduce) » Active

i'm not sure if there's any way to solve this, but I can definitely reproduce it. Did you turn on CSS caching? Once my CSS is cached, the HTTP and HTTPS no longer changes with the protocol of the current page. Instead, it just loads the cached version, which may not match the current page. For example, if the cached version was built on a request over HTTP, I still get the HTTP version when I've visiting a page over HTTPS.

BarisW’s picture

BarisW commented

I've enabled CSS and Page compression. The difference I see with my setup and the problem described here is that, for some reason, the link to the Google CSS on eallenboutique.com, is aggregated in the included CSS file.

See here CSS file and search for http: https://www.eallenboutique.com/sites/default/files/css/css_2e6b77de1bafd....

If I check my HTML head, the CSS files are called this way:

<link type="text/css" rel="stylesheet" href="https://drupal7/sites/default/files/css/css_Z_KQyXTcIGmFPRfGZOOTJ1xsEckXlqMhF53CkTgnOVA.css" media="all" />
<link type="text/css" rel="stylesheet" href="https://drupal7/sites/default/files/css/css_TsVRTbLFUpEZAfw-_bWPJu840QT523CPjUVJ5MRWfyk.css" media="all" />
<link type="text/css" rel="stylesheet" href="https://drupal7/sites/default/files/css/css_bqrUWhE7HPgyMrzRlPkigi_Of_VwwaFCpMsc2CgL2TA.css" media="all" />
<link type="text/css" rel="stylesheet" href="https://fonts.googleapis.com/css?family=Abel:regular&amp;subset=latin" media="all" />
<link type="text/css" rel="stylesheet" href="https://drupal7/sites/default/files/css/css_aJo9WEDw0bu9xxLcwZBkOrrP46XHyJwkj2t8wIMvBzk.css" media="all" />

You see that the Google CSS declaration is not aggregated. Not sure why it is on eallenboutique.com, but can it be possible that the used theme does some extreme CSS aggregation? Maybe with a hook_css_alter?

I just use a vanilla Drupal 7 with Bartik.

sreynen’s picture

sreynen commented
Status: Active » Closed (cannot reproduce)

Sorry, I was misremembering my testing on this. I thought I had tested this in my local test environment, but your links to the eallenboutique.com site reminded me I was actually just testing on that site. So I haven't actually reproduced this. I think you're probably right that it's doing some sort of extreme aggregation, and we'll need more info on that to do anything about this.

pmol123’s picture

pmol123 commented
Issue summary: View changes

In my case it was the $base_url causing the problem.
Commenting out the $base_url was not going to work for me.

Since I am using Apache the following worked for me in the settings.php file right after the $base_url setting.

Here is a section of my settings.php on my site.

$base_url = 'http://www.ExpertWitness.com';

//printf( "SERVER[REQUEST_SCHEME]=%s\n", $_SERVER['REQUEST_SCHEME'] );
if( $_SERVER['REQUEST_SCHEME'] == "https" )
   $base_url = str_replace( "http://", "https://", $base_url );

Demo:
http= http://www.ExpertWitness.com
https= https://www.ExpertWitness.com

Respectfully,

Patrick Michael O'Leary
http://www.PatrickOLeary.com