django Mixed Content: The page at '' was loaded over HTTPS, but requested an insecure resource swagger

  1. Problem Description: When loading a Django page over HTTPS, there is an issue with mixed content as an insecure resource (Swagger) is requested.

  2. Analysis: The issue is likely due to Swagger being loaded over HTTP while the main page is loaded over HTTPS. This violates the same-origin policy and leads to a mixed content error.

  3. Solution Steps: a. Update Swagger URL: Ensure that the Swagger URL used in your Django application starts with "https://" to match the secure origin.

b. Update Django Settings: In your Django settings, set the SECURE_SCHEME to "https" to enforce HTTPS. Also, set SECURE_SSL_REDIRECT to True to redirect all HTTP requests to HTTPS.

c. Update Swagger Configuration: If Swagger is configured in Django using DRF (Django Rest Framework), ensure that the USE_HTTPS setting is set to True in the Swagger configuration.

d. Update JavaScript Files: If Swagger is loaded via JavaScript, ensure that the script or configuration used to load Swagger specifies an "https://" URL.

e. Clear Browser Cache: After making changes, clear the browser cache to ensure that the updated configurations are applied.

f. Check for Relative URLs: Verify that there are no relative URLs used for Swagger resources. All resource references should explicitly use "http://" or "https://".

g. Update API Gateway Configurations: If Swagger is served through an API gateway or proxy, ensure that the gateway is configured to forward requests using "https://".

h. Test and Verify: Test the application after making these changes to ensure that the mixed content issue is resolved. Check the browser console for any remaining mixed content warnings.

  1. Documentation: Document the changes made to the Swagger configuration and Django settings for future reference. Ensure that the team is aware of the update to prevent similar issues in the future.