Mixing HTTP and HTTPS contents

At the bottom of this webpage we mix HTTP and HTTPS content: the webpage loads two iframes from xkcd.com, the left one with HTTP and the right one with HTTPS.

The webpage also includes JavaScript to create two pop-up windows, one loaded with http and one loaded with https. Your browser may be configured to disallow all pop-up windows, in which case you won't see any.

If you load this page via HTTPS, i.e. as https://www.cs.ru.nl/~erikpoll/websec/demo/mixed_content.html you should see something different then when you load it via HTTP, i.e. as http://www.cs.ru.nl/~erikpoll/websec/demo/mixed_content.html If you load it through HTTPS, your browser should refuse to include the HTTP content (i.e. the first popup and the subpage) and display a warning in the location bar. (This about why showing HTTP content in an HTTPS page is not a good idea.)

This demo no longer works in Firefox: Firefox automatically redirects to https and refuse to load the webpage via http. The demo does still work in Chrome. Not sure about Safari, Opera or Brave.