Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 3 down vote favorite

Facebook allows you to surf over a secure HTTPS connection, although sadly it does not enable this by default. Even when HTTPS is enabled, you encounter some annoying user experience when trying to access a Facebook application. It will output

Switch to regular connection (http)?

Sorry! We can’t display this content while you’re viewing Facebook over a secure connection (https).

To use this app, you’ll need to switch to a regular connection (http).

My question is twofold:

  1. Why does Facebook not enable HTTPS by default?
  2. Why does Facebook require disabling HTTPS when using a third-party application (apps.facebook.com).

NOTE - When looking for example apps that require the fallback to http, I couldn't find any. Did Facebook remove that requirement? If so, the second part of my question has become irrelevant. Instead, I wonder when and why this has changed.

share|improve this question
I was unsure if this question belongs here or on security.stackexchange.com. Feel free to move if necessary. – Honoki May 3 '12 at 13:11
2  
Not a real answer as I think you would need to talk to someone at Facebook for that..But to give an idea on question 2: If a 3rd party app is accessing services that are not setup for https (or hardcoded url that is not https), then it would make sense from a user experience perspective for Facebook to give this message. Otherwise, the user will get security warnings from their browser. By Facebook giving this message, and switching back to HTTP many non technical users wont freak out about the security errors. – zk. May 3 '12 at 13:42

2 Answers

up vote 4 down vote accepted

Some browsers, like IE6, show an error when we have non-secure (http) content e.g. iframe, image on secure (https) pages. To prevent this error dialog, Facebook falls back to a non-secure address. See these two StackOverflow questions too IE6 http/https mixed content error and dealing with http content in https pages.

Also this option will be disabled in the future to ensure user security and all apps should support https, according to Facebook Developer Blog:

... All Apps on Facebook (Canvas and Page Tabs) must support HTTPS by October 1.

share|improve this answer
1  
thanks @Feral Oink for nice edit on my answer ;) – Mohammad Ali Akbari May 3 '12 at 19:10
1  
You are most welcome! Your courtesy is appreciated (my first smile of the day). – Feral Oink May 4 '12 at 11:37
up vote 7 down vote

The reason most apps dont support HTTPS is because Facebook doesn't provide certificates for applications, this is the responsibility of the developer.

Explanation from another Q&A site:

Facebook apps are created through iFrame, not FBML as before. As iFrames are embedded websites, the code is hosted elsewhere, the source website must support HTTPS, which most websites dont (because of the extra costs).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.