How to fix blocked:mixed-content error on Application Gateway?

Najam ul Saqib 280 Reputation points
2024-09-04T07:21:43.22+00:00

I have configured an application gateway associated to a WAF with my app service, the goal was to use WAF in front of my app; the issue now is that I dont have custom domain for my application gateway or app service. Earlier I was using default domain of web app and now I am using default domain of app gateway that ends with .cloudapp.azure.com

The thing is that when I try to access my API via the frontend it throws this error, whereas when I access it via Postman its working fine.

I see this error is caused due to HTTP maybe, how can I get HTTPS on the default domain of app gateway since its not my custom domain so I cant add my SSL certificate.

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,048 questions
Azure Web Application Firewall
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
7,664 questions
0 comments
Accepted answer
  1. KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee
    2024-09-04T11:37:44.61+00:00

    @Najam ul Saqib ,

    I see this is related to the thread Is it possible to use .azurewebsites.net domain with application gateway?

    Can you please be more specific

    • What exactly do you mean by "access my API via the frontend"? Is this some third party Frontend or your own Frontend
    • The error message you shared seems to be related to the "Frontend" 's implementation.
    • As you mentioned, the configuration works with PostMan but the "Frontend" throws this error,
      • Doesn't that mean the error is specific to the "Frontend"
      • I would suggest you review the Frontend's logs or reach out to the Frontend vendor to understand what this error means

    A simple web search indicates that this could be related to a site serving a mix of HTTPS and HTTP Content.

    • If your application/Frontend has a requirement for HTTPS, you can consider using a custom domain.
    • See : end-to-end TLS encryption.

    Alternatively, you can consider using Azure Front Door which provides HTTPS capability even on the default domain.

    NOTE :

    • Using default domains or two different domains (one in proxy such as AFD/AppGW and one in the backend such as AppService) is not recommended as this could lead to potential issues such as
      • Incorrect absolute URLs

    The Implementation guidance from Azure would be to use a custom domain

    Hope this helps

    Thanks,

    Kapil

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.