path: root/files/pt-pt/web/security/conteudo_misto/index.html

---
title: Conteúdo misto
slug: Web/Security/Conteudo_misto
tags:
  - Consola
  - HTTP
  - HTTPS
  - Segurança
  - Web
translation_of: Web/Security/Mixed_content
---
<p>Quando um utilizador visita uma página servida sobre {{Glossary("HTTPS")}}, a sua ligação com o servidor da <em>Web </em>é encriptada com {{Glossary("TLS")}} e é, portanto, salvaguardada da maioria dos <em>sniffers</em> e ataques <em>man-in-the-middle</em>. Uma página HTTPS que inclui conteúdo obtido utilizando texto simples HTTP é chamada de de página de <strong>conteúdo misto</strong>. As páginas como esta são apenas parcialmente encriptadas, deixando o conteúdo não encriptado acessível aos <em>sniffers</em> e atacantes <em>man-in-the-middle</em>. Isso deixa as páginas inseguras.</p>

<h2 id="Tipos_de_conteúdo_misto">Tipos de conteúdo misto</h2>

<p>There are two categories for mixed content: <strong>mixed passive/display content</strong> and <strong>mixed active content</strong>. The difference lies in the threat level of the worst case scenario if content is rewritten as part of a man-in-the-middle attack. In the case of passive content, the threat is lower (the page may contain misleading content, or the user's cookies may be stolen). In the case of active content, the threat can lead to phishing, sensitive data disclosure, redirection to malicious sites, etc.</p>

<h3 id="Conteúdo_misto_passivode_exibição">Conteúdo misto passivo/de exibição</h3>

<p>Mixed passive/display content is content served over HTTP that is included in an HTTPS webpage, but that cannot alter other portions of the webpage. For example, an attacker could replace an image served over HTTP with an inappropriate image or message to the user. The attacker could also infer information about the user's activities by watching which images are served to the user; often images are only served on a specific page within a website. If the attacker observes HTTP requests to certain images, they could determine which webpage the user is visiting.</p>

<h4 id="Lista_de_conteúdo_passivo">Lista de conteúdo passivo</h4>

<p>This section lists all types of HTTP requests which are considered passive content:</p>

<ul>
 <li>{{HTMLElement("img")}} (<code>src</code> attribute)</li>
 <li>{{HTMLElement("audio")}} (<code>src</code> attribute)</li>
 <li>{{HTMLElement("video")}} (<code>src</code> attribute)</li>
 <li>{{HTMLElement("object")}} subresources (when an <code>&lt;object&gt;</code> performs HTTP requests)</li>
</ul>

<h3 id="Conteúdo_ativo_misto">Conteúdo ativo misto</h3>

<p><strong>Mixed active content</strong> is content that has access to all or parts of the Document Object Model of the HTTPS page. This type of mixed content can alter the behavior of the HTTPS page and potentially steal sensitive data from the user. Hence, in addition to the risks described for mixed display content above, mixed active content is vulnerable to a few other attack vectors.</p>

<p>In the mixed active content case, a man-in-the-middle attacker can intercept the request for the HTTP content. The attacker can also rewrite the response to include malicious JavaScript code. Malicious active content can steal the user's credentials, acquire sensitive data about the user, or attempt to install malware on the user's system (by leveraging vulnerabilities in the browser or its plugins, for example).</p>

<p>The risk involved with mixed content does depend on the type of website the user is visiting and how sensitive the data exposed to that site may be. The webpage may have public data visible to the world or private data visible only when authenticated. If the webpage is public and has no sensitive data about the user, using mixed active content still provides the attacker with the opportunity to redirect the user to other HTTP pages and steal HTTP cookies from those sites.</p>

<h4 id="Exemplos_de_conteúdo_ativo">Exemplos de conteúdo ativo</h4>

<p>This section lists some types of HTTP requests which are considered active content:</p>

<ul>
 <li>{{HTMLElement("script")}} (<code>src</code> attribute)</li>
 <li>{{HTMLElement("link")}} (<code>href</code> attribute) (this includes CSS stylesheets)</li>
 <li>{{HTMLElement("iframe")}} (<code>src</code> attribute)</li>
 <li>{{domxref("XMLHttpRequest")}} requests</li>
 <li>{{domxref("GlobalFetch.fetch","fetch()")}} requests</li>
 <li>All cases in CSS where a {{cssxref("url")}} value is used ({{cssxref("@font-face")}}, {{cssxref("cursor")}}, {{cssxref("background-image")}}, and so forth).</li>
 <li>{{HTMLElement("object")}} (<code>data</code> attribute)</li>
</ul>

<p>Other resource types like web fonts and workers may be considered active mixed content, <a href="https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit/Source/core/loader/MixedContentChecker.cpp&amp;q=MixedContentChecker::contextTypeFromContext%20f:cpp&amp;sq=package:chromium&amp;type=cs">as they are in Chromium</a>.</p>

<h2 id="Avisos_na_Consola_da_Web">Avisos na Consola da <em>Web</em></h2>

<p>The Firefox Web Console displays a mixed content warning message in the Net pane when a page on your website has this issue. The mixed content resource that was loaded via HTTP will show up in red, along with the text "mixed content", which links to this page.</p>

<p><a class="internal" href="/files/12545/Mixed_content_-_Net_pane.png"><img alt="Screen shot of the web console displaying a mixed content warning." src="https://mdn.mozillademos.org/files/12545/Mixed_content_-_Net_pane.png" style="border-style: solid; border-width: 1px; height: 286px; width: 720px;"></a></p>

<p>As well as finding these warnings in the Web Console, you could use <a href="/en-US/docs/Web/HTTP/CSP">Content Security Policy (CSP)</a> to report issues or a website crawler to find issues across your site, such as <a href="https://httpschecker.net/guides/https-checker">HTTPS Checker</a> or <a href="https://github.com/bramus/mixed-content-scan">Mixed Content Scan</a>.</p>

<p>Starting in Firefox 23, mixed active content is blocked by default (and mixed display content can be blocked by setting a preference). To make it easier for web developers to find mixed content errors, all blocked mixed content requests are logged to the Security pane of the Web Console, as seen below:</p>

<p><a href="/files/5261/blocked-mixed-content-errors.png"><img alt="A screenshot of blocked mixed content errors in the Security Pane of the Web Console" src="https://mdn.mozillademos.org/files/12543/mixed_content_webconsole.png" style="border-style: solid; border-width: 1px; height: 285px; width: 720px;"></a></p>

<p>To fix this type of error, all requests to HTTP content should be removed and replaced with content served over HTTPS. Some common examples of mixed content include JavaScript files, stylesheets, images, videos, and other media.</p>

<div class="note">
<p><strong>Nota</strong>: a partir do Firefox 55, o carregamento de conteúdo misto é permitido em http://127.0.0.1/ (see {{bug(903966)}}).  O Chrome permite conteúdo misto em http://127.0.0.1/ e http://localhost/. O Safari não permite conteúdo misto.</p>
</div>

<h2 id="Consultar_também">Consultar também</h2>

<ul>
 <li><a href="https://w3c.github.io/webappsec/specs/mixedcontent/" title="https://w3c.github.io/webappsec/specs/mixedcontent/">Conteúdo Misto - W3C Editor's Draft</a></li>
 <li><a href="/pt-PT/docs/Web/Security/Mixed_content/Como_corrigir_um_site_da_Web_com_conteudo_misto_bloqueado">Como corrigir um site da Web com conteúdo misto bloqueado</a></li>
</ul>