Why we can embed pdf from HTTPS but can not from HTTP?

Question

Comparison sample:

Embed pdf from HTTPS:
https://code.sololearn.com/WN9fBXwW3Q6o/#html
image result:
https://s1.postimg.org/6zwfnbme1b/Screenshot_16.png

Embed pdf from HTTP:
https://code.sololearn.com/WDWiL1xEBio8/#html
image result:
https://s1.postimg.org/1h09v7dtq7/Screenshot_17.png

Answer 1

You may open the browser console by pressing F12 to observe the error.

In this case it's due to the mixed-content security issue as it's trying to load HTTP resource from a HTTPS site (i.e. SoloLearn).

The user will be vulnerable and loss the protection from HTTPS and therefore Chrome blocks it by default to protect the user. 😉

📖 Good read:
https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content

Answer 2

@Zephyr Koo
Very interesting.

@Adi Pratama
Hi. How are you?
My guess was that, for security, the site blocks HTTP PDFs so that you're not embedding a *.pdf.exe file, and so that no one accidentally downloads it.

Answer 3

@Adi
It's fine.

Answer 4

@Adi Pratama
Hi. I've finished developing my first Android app, and if you would like to check it out, here's a link to the thread. Have a nice day.

*Thread Removed*