Dear Iris,

The "Mixed Content" error you're encountering in your Odoo website editor indicates that some resources are still being loaded over HTTP even though your site is configured for HTTPS. This can happen for a few reasons. Here are some steps you can take to fix the issue:

1. Check Nginx Configuration (if applicable):

• If you're using Nginx as a reverse proxy for your Odoo container, ensure your configuration includes the following directives:
  • proxy_set_header X-Forwarded-Proto https;
  • This tells Odoo that the request originated from an HTTPS connection.
• You can typically find your Nginx configuration file within the Docker volume mapped to the Nginx container. Look for sections related to proxying requests to Odoo.

2. Odoo Configuration:

• In your Odoo configuration file (odoo.conf), make sure the web.base.url parameter is set to the HTTPS version of your website URL (e.g., https://www.yourdomain.com).
• Additionally, consider enabling proxy_mode = True in the [options] section of odoo.conf. This helps Odoo handle headers correctly when behind a proxy server like Nginx.

3. Website Editor Iframe URL:

• In some cases, the website editor iframe URL might still be using HTTP. You might need to modify the website.editor route in your reverse proxy configuration (e.g., Nginx) to add a middleware that updates the iframe URL to HTTPS.

4. Clear Browser Cache:

• Sometimes, your browser might be holding onto cached resources loaded over HTTP. Try clearing your browser cache and reloading the Odoo website editor.

5. Cloudflare Settings:

• Double-check your Cloudflare settings for the "Flexible SSL" option. While "Flexible" might serve content over HTTPS, it might not automatically force all resources to be loaded securely. Consider switching to a stricter SSL mode in Cloudflare if available (e.g., "Full" or "Full (Strict)").

Additional Resources:

• Odoo forum discussion on similar issue: https://www.odoo.com/forum/help-1/mixed-content-request-from-an-insecure-resource-140344
• Guide on preventing mixed content: https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content

By following these steps and checking your specific configuration details, you should be able to eliminate the mixed content error and ensure your Odoo website editor works seamlessly with HTTPS.

I have the same issue on a fresh clean setup/install and with the 1st BLANK WEBSITE installed from template (which the please wait for the template to be installed never finishes loading because of the coding error internal to the program) so any MIXED errors are 100% in the system and nothing added by me the end user. I even opened a ticket that took several days to get a response. The response was, look for a response on the forum. (meaning you are likely to never get one from the company).

It's a coding issue the community developers and contributors have to fix https://github.com/odoo/. 

If you do get an answer from Odoo the company  - do NOT let them pass this particular issue off on a docker, or the docker network either. I spend my entire Saturday testing and QAing this platform for its limits and viability for my project (docker/source/windows installer). Its a great platform for the most part. 

This https/http MIXED error is the SAME on all CE install method versions. So the bottom line is the problem exists in the code (not installation/platform). 

I have resolved this to the following facts...

• The issue only happens when trying to use the system as an administrator doing certain functions, like deploying the initial website or editing an existing website. there was another for eLearning module editing too but its the same website issue dependency underlying issue
• • @odoo team - this is key because https either works or it does not, and why this is a coding issue that I really wish someone would look into more closely.
• As a public user viewing the site, the https not working issue goes away, and the site works fine and as expected https. 

take away is tunnel in using cloudflare, or twingate, and hit the site as admin when you need to perform backend admin functions by:

• http://192.168.x.x / 172.16.x.x / 10.x.x.x
• http://127.0.0.1
• http://localhost
• http://YourHostName

Its a pain in the %#$# but it's free 😁 so... or pay for the real macoy and get odoo.sh which has the best options for folks wanting backups/ higher performance and reliability plus ALM to experiment before pushing changes to production

I do not think there is any incentive to fix this.

Hi, guys,

I'm also using a similar setup: HAProxy + Odoo 17 Community running in a Docker container. I had the exact same issue. After spending time looking for a solution, I managed to do it this way:

I tried adding a header:

http-response set-header Content-Security-Policy upgrade-insecure-requests

However, that fixed it only in Firefox. Chrome and Edge still had the issue. Then, after looking at the requests the browser makes, I noticed that there is a Location header in the response which points to an http URL. So, I decided to try changing it with:

http-response replace-header Location ^http://my_domain(.+) https://my_domain\1​

Voila, now it works in all browsers. I don't know if this solution is a good one, but I don't have another option at the moment. I hope it will be useful for other people in my situation too.

Hi, Guys. I already made all the recommendations, but I'm still having the same problem. I don't know what to do if I made all changes. Can anyone help me.

I'm using:

- Docker

-Nginx

- Odoo 17 community version.