Need workaround for insecure XMLHttpRequest endpoint request

Question

I'm building an aggregator of sorts in WordPress that pulls posts using the new API from specific sites. Most if not all of these sites will not have SSL, thus HTTP. Of course, I'm getting "Mixed Content: The page [xxx] was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint [yyy]. This request has been blocked; the content must be served over HTTPS."

For the record, I'm utilizing the posts API to pull in the feeds, i.e., "http://somesite.com/wp-json/wp/v2/posts"

I've tried various CORS methods (setting headers in functions.php, CORS plugins, you name it), as well as adding origin sites to the allowed origins:

add_filter( 'allowed_http_origins', 'add_allowed_origins' );
function add_allowed_origins( $origins ) {
    $origins[] = 'http://somesite.com';
    return $origins;
}

I don't own the other sites, so I can't very well insist that they get an SSL cert. But it seems I'm stuck, unless someone has a fix I haven't tried? Any help appreciated.

Answer 1

I think your only option is to build a small proxy, a PHP function on your own site to which you pass the URL you want to grab. That call, being to your own site (ajax call) will be using the same protocol as your site.

The PHP code receives the ajax call, turns around and gets the remote content (either using file_get_contents or cURL) and returns the content of the response as its ajax call response.

It's not pretty, and you will take a speed hit for this, but you now totally bypass the browser's security warnings...

Hope this helps!