Facebook allows you to surf over a secure HTTPS connection, although sadly it does not enable this by default. Even when HTTPS is enabled, you encounter some annoying user experience when trying to access a Facebook application. It will output

Switch to regular connection (http)?

Sorry! We can’t display this content while you’re viewing Facebook over a secure connection (https).

To use this app, you’ll need to switch to a regular connection (http).

My question is twofold:

  1. Why does Facebook not enable HTTPS by default?
  2. Why does Facebook require disabling HTTPS when using a third-party application (apps.facebook.com).

NOTE - When looking for example apps that require the fallback to http, I couldn't find any. Did Facebook remove that requirement? If so, the second part of my question has become irrelevant. Instead, I wonder when and why this has changed.

  • I was unsure if this question belongs here or on security.stackexchange.com. Feel free to move if necessary.
    – Honoki
    May 3, 2012 at 13:11
  • 2
    Not a real answer as I think you would need to talk to someone at Facebook for that..But to give an idea on question 2: If a 3rd party app is accessing services that are not setup for https (or hardcoded url that is not https), then it would make sense from a user experience perspective for Facebook to give this message. Otherwise, the user will get security warnings from their browser. By Facebook giving this message, and switching back to HTTP many non technical users wont freak out about the security errors.
    – zk.
    May 3, 2012 at 13:42

2 Answers 2


Some browsers, like IE6, show an error when we have non-secure (http) content e.g. iframe, image on secure (https) pages. To prevent this error dialog, Facebook falls back to a non-secure address. See these two StackOverflow questions too IE6 http/https mixed content error and dealing with http content in https pages.

Also this option will be disabled in the future to ensure user security and all apps should support https, according to Facebook Developer Blog:

... All Apps on Facebook (Canvas and Page Tabs) must support HTTPS by October 1.

  • 1
    You are most welcome! Your courtesy is appreciated (my first smile of the day). May 4, 2012 at 11:37

The reason most apps dont support HTTPS is because Facebook doesn't provide certificates for applications, this is the responsibility of the developer.

Explanation from another Q&A site:

Facebook apps are created through iFrame, not FBML as before. As iFrames are embedded websites, the code is hosted elsewhere, the source website must support HTTPS, which most websites dont (because of the extra costs).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.