Mixed Content error when trying to "Connect with Square".

[JacobSussan]

Describe the bug

Connect With Square button does not work.

Console log: Mixed Content: The page at 'x' was loaded over HTTPS, but requested an insecure resource 'http://squareup.com/t/cmtp_performance/pr_cross_product/d_partnerships/p_woocommerce/cn_oauth?client_id=x&route=oauth2/authorize?....' This request has been blocked; the content must be served over HTTPS.

To reproduce

1. Click "Connect With Square"

Environment (please complete the following information):

• WordPress Version 6.6
• WooCommerce Version 9.1.2
• WooCommerce Square Plugin Version 4.7.0
• Chrome 126.0.6478.126/127 / 24 June 2024

Additional details

Backend is in an iFrame.

[imodouglas]

8511064-zen

[iamdharmesh]

Hi @JacobSussan,

Thank you for reporting the issue.

I have checked this, but I am unable to reproduce it. Could you please provide more information, such as a screenshot or screencast? Also, you mentioned Backend is in an iFrame.. Could you please provide more information on it? This will help us understand the exact issue and identify its root cause.

During the connection, I noticed one redirect with HTTP (http://squareup.com/t/cmtp_performance/....), but it is not blocked by my browser, and I am able to connect successfully without any issues.

Thank you.
cc: @imodouglas

[JacobSussan]

https://i.imgur.com/G1R6z1d.mp4

Setup is like this, but it happens whenever you load from an iFrame at all, as far as I can test.

WordPress lives on https://123.abc.com.

create a page on https://abc.com (no 123) with an iFrame to https://123.abc.com

Click on "Connect to Square" via iFrame.

Error occurs.

Tried on Chrome 126 & Firefox 128.0.2

[iamdharmesh]

Hi @JacobSussan,

Thank you for providing the details. I am able to reproduce the issue when loading wp-admin in the iframe instead of accessing it directly through the browser. It appears that Square initiates one HTTP redirect request. I am reaching out to Square support to get more information on this and will update you once we have further details.

Thank you.

[jeffpaul]

Marking this as blocked until we response from Square on proper handling.