Mixed Content: The page at 'https://web-b2c-2-production.up.railway.app/' was loaded over HTTPS
pawar-ashwin
HOBBYOP

2 months ago

Hi,
Am unable to access the backend features through frontend when it comes to the PC chrome browser, but when am doing the same thing on mobile it is working and am able to access. Am not sure why is this happening.

Error :

Mixed Content: The page at 'https://web-b2c-2-production.up.railway.app/' was loaded over HTTPS, but requested an insecure resource 'http://celestia-api-production.up.railway.app/api/v1/profiles/'. This request has been blocked; the content must be served over HTTPS.

Solved$10 Bounty

Pinned Solution

pawar-ashwin
HOBBYOP

2 months ago

Guys I finally fixed it and am attaching a explanation of why it happened and what we can learn from that, thank you so much for your support and time, I really appreciate it!

10 Replies

enlorik
HOBBY

2 months ago

You’re just running into a mixed content issue here.

Your frontend is being served over HTTPS:

https://web-b2c-2-production.up.railway.app/

but the code is calling the API over plain HTTP:

http://celestia-api-production.up.railway.app/api/v1/profiles/

When a page is loaded over HTTPS, the browser will block any HTTP requests from it, which is exactly what that “Mixed Content” error means.

If you open the API URL directly in the browser with HTTPS:

https://celestia-api-production.up.railway.app/api/v1/profiles/

you can see a JSON error about a missing Authorization header. That shows the backend itself is fine and reachable over HTTPS.

So the fix is just to make all API calls use HTTPS as well, for example:

// before

const API_BASE = "http://celestia-api-production.up.railway.app";

// after

const API_BASE = "https://celestia-api-production.up.railway.app";

(or set an env like VITE_API_URL / NEXT_PUBLIC_API_URL to the HTTPS URL and use that in your frontend).

Once both frontend and backend are on HTTPS, the mixed content warning goes away, and then you only need to make sure you’re sending the correct Authorization header the API expects.


enlorik

You’re just running into a mixed content issue here.Your frontend is being served over HTTPS:https://web-b2c-2-production.up.railway.app/but the code is calling the API over plain HTTP:http://celestia-api-production.up.railway.app/api/v1/profiles/When a page is loaded over HTTPS, the browser will block any HTTP requests from it, which is exactly what that “Mixed Content” error means.If you open the API URL directly in the browser with HTTPS:https://celestia-api-production.up.railway.app/api/v1/profiles/you can see a JSON error about a missing Authorization header. That shows the backend itself is fine and reachable over HTTPS.So the fix is just to make all API calls use HTTPS as well, for example:// beforeconst API_BASE = "http://celestia-api-production.up.railway.app";// afterconst API_BASE = "https://celestia-api-production.up.railway.app";(or set an env like VITE_API_URL / NEXT_PUBLIC_API_URL to the HTTPS URL and use that in your frontend).Once both frontend and backend are on HTTPS, the mixed content warning goes away, and then you only need to make sure you’re sending the correct Authorization header the API expects.

pawar-ashwin
HOBBYOP

2 months ago

I tried everything, even I tried hardcoding https during API calls, but when am deploying on the railways, I don't know what is happening the error keeps on repeating!


pawar-ashwin

I tried everything, even I tried hardcoding https during API calls, but when am deploying on the railways, I don't know what is happening the error keeps on repeating!

userdeh
HOBBY

2 months ago

Hi,
i check the web page and every things load perfectly.

if there is still an issue, please take a screenshot and attach here.


userdeh

Hi,i check the web page and every things load perfectly.if there is still an issue, please take a screenshot and attach here.

pawar-ashwin
HOBBYOP

2 months ago

Yes the webpage is accessible but certain features in the webpage are not being accessible on the PC browser...
Let me explain you clearly, so there is certain endpoint in the application and the route is (https://web-b2c-2-production.up.railway.app/dashboard/applications) and when am trying to access it using the PC or laptop browser it is continuously loading with nothing am attaching a screenshot, sam goes with the other options like My Documents, Extracted Data etc

But if I access the same route in my ipad or mobile (only chrome browser) then am seeing the page there is no infinite reload and what's weird is it is not working on safari browser of mobile or ipad, am attaching the screenshots for your reference. Thank you for the support!


pawar-ashwin

Yes the webpage is accessible but certain features in the webpage are not being accessible on the PC browser...Let me explain you clearly, so there is certain endpoint in the application and the route is (https://web-b2c-2-production.up.railway.app/dashboard/applications) and when am trying to access it using the PC or laptop browser it is continuously loading with nothing am attaching a screenshot, sam goes with the other options like My Documents, Extracted Data etc But if I access the same route in my ipad or mobile (only chrome browser) then am seeing the page there is no infinite reload and what's weird is it is not working on safari browser of mobile or ipad, am attaching the screenshots for your reference. Thank you for the support!

userdeh
HOBBY

2 months ago

send a screenshot from browser console + network request on that PC or Laptop


userdeh

send a screenshot from browser console + network request on that PC or Laptop

pawar-ashwin
HOBBYOP

2 months ago

Sure, I have attached the console error + Network tab


pawar-ashwin

Sure, I have attached the console error + Network tab

userdeh
HOBBY

2 months ago

search 'http' in your front-end souce code or environment variables, change the http to https

your backend url was set with http scheme and it should change to https. just it


enlorik
HOBBY

2 months ago

From your latest console screenshot, the frontend is still calling http://celestia-api-production.up.railway.app/api/v1/profiles while the API is available over https. Chrome blocks that as mixed content, which is why desktop shows infinite loading. Update your frontend base API URL / env var to use https://celestia-api-production.up.railway.app (no http anywhere), redeploy, and the dashboard/applications page should start working again on PC.


userdeh

search 'http' in your front-end souce code or environment variables, change the http to httpsyour backend url was set with http scheme and it should change to https. just it

pawar-ashwin
HOBBYOP

2 months ago

I made sure everything is https, and redeployed 5 to 6 times before but no change the site and options work on mobile browser but not on the PC or laptop browser :(


pawar-ashwin
HOBBYOP

2 months ago

Guys I finally fixed it and am attaching a explanation of why it happened and what we can learn from that, thank you so much for your support and time, I really appreciate it!


Status changed to Solved uxuz 2 months ago


Loading...