Views: 2770
Number of votes: 4
Average rating:

Commerce Manager over HTTPS with load balancer

Commerce Manager - either you like it or hate it - is still an important part of Commerce, and there are functionalities which can't be found else where, so you will have to stick with it for the time being. And as it's important enough, it's a recommended practice to secure the site with HTTP over SSL - aka HTTPS (Along with other security measures such as put it behind a firewall or limit access to trusted IP only, etc.). However, it might be a problem if you want to put it behind some load balancer. This kind of message can be seen in such scenario (via browser console):

default.aspx:1 Mixed Content: The page at '' was loaded over HTTPS, but requested an insecure script ''. This request has been blocked; the content must be served over HTTPS.

Due to your browser configuration, you might not access the site because it blocks the mixed content. While HTTPS is great, mixed content can open doors for attacks like Man in the middle and it's best that browsers disable that by default.

But that can be solved, easily enough, if you:

  • Upgrade your site to at least Commerce 10.6.0, to have this bug fixed
  • Configure the header X-Forwarded-Proto to "https" on your load balancer. Because most of the load balancers will redirect to non-HTTPS requests before they reach to ASP.NET (in this case, Commerce Manager), then we need a way to know that the request was on HTTPS or not, to load the assets correctly.

And now your Commerce Manager will be happily working over HTTPS, behind a load balancer.

Jul 07, 2017

Islam Hamed
( By Islam Hamed, 1/31/2019 8:45:15 PM)

Hey Quan,

We are facing this issue now with one of our clients with version 10.4.3.

I just want to confirm if the above 2 solutions have to be done together or either of them? Can we skip the upgrade and only do the load balancer one?


Quan Mai
( By Quan Mai, 2/1/2019 7:49:33 AM)

Hi Islam, They should be in together

Please login to comment.