Hello,

I have been stepping through the process of securing a store installation. I am using SSL_Module (Toms) with good success on 4.3.2

I was happy to see that the ssl worked perfectly on firefox. All the visual clues (lock, etc) were in order.

When i tested in IE6 SP2, however, it wasn't so nice.
All of the visual clues for the checkout page disappeared, leaving me with  an unsecured feeling for my customers' sakes. The lock icon was gone, although the url still said https://

I was just about to post here asking if there was any known issues with my particular combination of technologies when i stumbled over the smoking gun.

On the checkout page, Thumbnail.aspx is used to generate the thumbnail for the order overview. I noticed that everything looked great in IE (lock icon, etc) until the thumbnail loaded. Viewing the source of the generated page, I noted that the src tag of the thumbnail is (of course) thumbnail.aspx. This is, in fact, the rub.

I.E. is trying to protected me from illegitimate image "bugs" (images that are actually applications and tracking me) Thus it doesnt consider a page "secure" if it has an image bug. Unfortunately the thumbnail system of this cart looks alot like an image bug. Thus IE loudly observes that my checkout page is insecure. (Can you hear my customers running for the door?)

I have verified this by removing the product image. Magically IE thinks my page is legit once more.

This is a fairly big confidence issue. A quick look at my page stats shows me that IE users of this kind constitute 20% of the visitors to my site.  What percentage of those are brave enough to risk an "insecure" page?

Is this a known issue and i have just missed it in the forums? If so, pardon me for beating a dead horse.

Im sure, however that this is reproducible.

-ee-

---

-ee-