Mixed content in Web Player

[rythie]

Chrome warns me that the web player has some mixed content. From looking at the console it looks like music is being loaded over a regular HTTP connection.

Example messages from the console:

"Mixed Content: The page at 'https://play.spotify.com/browse' was loaded over HTTPS, but requested an insecure plugin data 'http://audio-mp3-fa.spotify.com/crossdomain.xml'. This content should also be served over HTTPS."

"Mixed Content: The page at 'https://play.spotify.com/artist/[redacted]' was loaded over HTTPS, but requested an insecure plugin data 'http://audio-mp3-fa.spotify.com/mp3enc/[redacted]'. This content should also be served over HTTPS."

I'm using Chrome on RedHat Enterprise Linux 7.

[Dreadlord]

Hey @rythie,

Welcome to Spotify Community!

Can you clarify what is the issue?

This is how the web player works for its entire existence 🙂

[rythie]

In short there is no green lock symbol next to URL.

Longer version:

It's not secure and it's not private. Every album cover or song I play is idenifyable by those on the network. Images and music can be replaced with objectional content that's not suitable for some users or used to exploit the browser like CVE-2015-1220 was in the past and other likely in the future.

There is some information on the problems with this here:

https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content

I had assumed this was temporary bug that would be solved soon, but it seems no one has even reported it as an issue.

[Dreadlord]

Hello @rythie,

Images are served over https. The only thing that is served over HTTP is the audio because the player is still using flash, so nothing is identifiable 🙂

[rythie]

At least some of the images are still using HTTP e.g.

"Mixed Content: The page at 'https://play.spotify.com/radio/genre/soul' was loaded over HTTPS, but requested an insecure image 'http://o.scdn.co/[redacted]'. This content should also be served over HTTPS."

jquery.min.js:3 Mixed Content: The page at 'https://play.spotify.com/radio/genre/dance' was loaded over HTTPS, but requested an insecure image 'http://o.scdn.co/640/[redacted]'. This content should also be served over HTTPS.

Mixed Content: The page at 'https://play.spotify.com/radio/genre/dance' was loaded over HTTPS, but requested an insecure image 'http://o.scdn.co/300/[redacted]'. This content should also be served over HTTPS.

You hit these all the time from the radio page.