Currently, I am faced with a challenge in making an XmlHTTPRequest POST request from a page loaded via HTTPS to a different domain using an HTTP URL. The HTTP server in question is local and does not support HTTPS due to being within a home setup (like a set-top box). Upon sending the POST request, my server responds with the following headers:
'Access-Control-Allow-Origin': '*',
'Access-Control-Allow-Methods' : 'GET, POST, PUT, DELETE, OPTIONS'
However, when attempting to make the POST request, it seems like the browser is canceling it. In the console, I receive the warning message:
The page at 'https://xxx.html' was loaded over HTTPS, but displayed insecure content from 'http://localhost:10293/yyy': this content should also be loaded over HTTPS.
Is there a solution to enable this functionality?
An intriguing observation is that while the POST request gets canceled by the browser, I can successfully send a DELETE request to the same HTTP server. The server handles the 'OPTION' request and provides the necessary 'Access' headers mentioned earlier. However, even though the warning appears for the DELETE request, it goes through unlike the POST request.
The server in question operates on a basic node.js framework.