This request content must be served over HTTPS about gradio HOT 7 CLOSED

@freddyaboulton thanks for taking a look
this line only populates the share editor blocks; the iframe was accessed through HTTPS

if hf_space_host: iframe_src = f"https://{hf_space_host}/q?query_id={query_id}"

The MixedContent problem was due to a RedirectResponse (commented out in the very end). Initially the landing page (the / route) was redirecting to a /sql endpoint. Looking through the dev tools / network panel, I could see that one of the calls during a redirect was over HTTP. I did not save the screenshot, but it was happening with this commit (I tried setting the proto header too).

In the end, I fixed it by mounting the gradio app to / and handling the absent query parameters to create a functional equivalent of a redirect.

from gradio.

Hi @LeXwDeX , can you try setting the x-forwarded-proto header to https?

from gradio.

Hi @LeXwDeX , can you try setting the x-forwarded-proto header to https?

Oh my God, After adding this header, it works.

conf snippet now:

location / {
                proxy_pass http://localhost:7860;
                proxy_set_header X-Forwarded-Proto $scheme;

from gradio.

@freddyaboulton

I have something possibly related going on...
My app in HF spaces it is complaining about insecure iframes.

index.js:1 Mixed Content: The page at 'https://huggingface.co/spaces/liquidcarbon/duckdb-fastapi-gradio' was loaded over HTTPS, but requested an insecure frame 'http://liquidcarbon-duckdb-fastapi-gradio.hf.space/sql/?alias=example1'. This request has been blocked; the content must be served over HTTPS.

It works locally, in container, and when started from
http://liquidcarbon-duckdb-fastapi-gradio.hf.space/sql/?alias=example1
but not from
https://huggingface.co/spaces/liquidcarbon/duckdb-fastapi-gradio

it's likely from my RedirectResponse to another endpoint from the landing page; I tried setting the header but it did not work.
https://huggingface.co/spaces/liquidcarbon/duckdb-fastapi-gradio/blob/main/main.py#L167

from gradio.

I think the issue is the iframe needs to be accessed over https here: https://huggingface.co/spaces/liquidcarbon/duckdb-fastapi-gradio/blob/89caffe982f0742877cc00729a925c1aa60a5ba7/main.py#L133

from gradio.

Glad you found the issue! Seems like a bug with the RedirectResponse class then?

from gradio.

I'm not sure! Starlette/FastAPI RedirectResponse doesn't concern itself with http/https directly, as far as I understand.
I think it's something with HF spaces internals. The app itself is served in an iframe, and something in there is not handling redirects properly.

If you do "view page source" on the main app page, https://huggingface.co/spaces/liquidcarbon/duckdb-fastapi-gradio

from gradio.