DRM Protected Content - Mixed Content Blocked

Issue

Mixed Content is Blocked. 

• This issue occurs when the application is served over a secure connection (HTTPS), but it attempts to load certain resources (such as images, scripts, or publicity/content assets) over an insecure connection (HTTP). Modern mobile platforms, including Android applications (WebView) and Apple iOS/iPadOS applications (WKWebView/Safari technologies), enforce security policies that restrict or block this type of behavior, known as mixed content.

  Because of this:

  • The mobile application blocks the insecure (HTTP) content from loading.
  • Publicity images, artwork, or other content elements may fail to display within the application.
  • Content may appear incomplete or broken even though the main application page loads successfully over HTTPS.

Confirmation:

Android

Request a Logcat capture while the issue is occurring. The log may contain messages similar to:

Mixed Content: 

The page at 'https://YourDomain.com/movies' was loaded over HTTPS, but requested an insecure image 'http://YourDomain.com/OnDemand/2.0/images/0058928_2116395640.jpg'. This content should also be served over HTTPS.

This confirms that the application is attempting to load HTTP resources from an HTTPS page.

Apple (iOS / iPadOS)

Apple devices may not generate the same mixed-content message in customer-facing logs, but the behavior is often observed as:

• Missing publicity images or artwork
• Blank content areas where images should appear
• Failed network requests visible in application diagnostics, developer logs, Safari Web Inspector, or MDM monitoring tools

Because Apple platforms enforce App Transport Security (ATS) and secure web content policies, HTTP resources may be blocked when requested from HTTPS pages.

Additional Confirmation:

1. Removing the "s" from https loads the content.
   • This is another sign of mixed-content behavior.
2. Invoke-WebRequest in PowerShell:

   • Invoke-WebRequest http://yourdomain.com/OnDemand/2.0/images/0058928_2116395640.jpg -UseBasicParsing

   • HTTP works, HTTPS fails 
      

Root Cause

The application loads its main interface over HTTPS, but requests assets from servers over HTTP. Modern application security policies restrict or block these mixed-content requests.
 
 

Suggested Actions

Validate that all servers and network components between the player application and the content server are compliant with HTTPS/SSL requirements.
 

• Confirm whether any proxies, load balancers, gateways, or forwarding services are:
  • terminating SSL (TLS offload)
  • redirecting traffic between HTTP and HTTPS
• Verify that any system handling HTTPS traffic:
  • has a valid SSL certificate
  • supports modern TLS protocols (TLS 1.2+)
• Ensure there are no intermediate systems downgrading or rewriting requests from HTTPS → HTTP
• Check that certificate chains are complete and trusted (no self-signed or missing intermediates)