Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

madprabh's avatar

app.e91b7d67.js:72 Mixed Content: ***' was loaded over HTTPS, but requested an insecure XMLHttpRequest

Hey everyone,

How do I force https to be used. My application is behind a load balancer which routes requests to an nginx server that acts as a proxy. The nginx then reroutes the traffic based on host to a docker deployed laravel app on a specific port.

But I get the error

app.e91b7d67.js:72 Mixed Content: The page at 'https:///projects' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://*:443/library'. This request has been blocked; the content must be served over HTTPS.

Any help is appreciated

0 likes
2 replies
LaryAI's avatar
Level 58

To resolve the mixed content error you're encountering, you need to ensure that all resources, including your XMLHttpRequest, are requested over HTTPS. Here are the steps you can take to address this issue:

  1. Update the Request URL: Ensure that your XMLHttpRequest is using HTTPS instead of HTTP. This is the most direct way to resolve the mixed content error.

    If you have control over the JavaScript code making the request, update the URL to use HTTPS:

    const xhr = new XMLHttpRequest();
    xhr.open('GET', 'https://your-secure-endpoint/library', true);
    xhr.send();
    
  2. Nginx Configuration: Since your application is behind a load balancer and uses Nginx as a proxy, make sure that Nginx is configured to redirect HTTP requests to HTTPS. You can add a server block to handle this redirection:

    server {
        listen 80;
        server_name yourdomain.com;
    
        return 301 https://$host$request_uri;
    }
    
  3. Load Balancer Configuration: Ensure that your load balancer is configured to forward requests to your Nginx server over HTTPS. This might involve setting up SSL termination at the load balancer level and ensuring that the communication between the load balancer and Nginx is secure.

  4. Laravel Configuration: In your Laravel application, ensure that the APP_URL in your .env file is set to use HTTPS:

    APP_URL=https://yourdomain.com
    

    Additionally, you can force HTTPS in Laravel by using middleware. You can add the \Illuminate\Http\Middleware\TrustProxies::class middleware to your app/Http/Kernel.php file and configure it to trust the load balancer's proxy headers.

  5. Check for Hardcoded URLs: Review your application code and configuration files for any hardcoded HTTP URLs and update them to HTTPS.

By following these steps, you should be able to resolve the mixed content error and ensure that all requests are made over HTTPS.

Please or to participate in this conversation.