title: Authorise mixed content <a href> tag?
body: <p>i have an issue with mixed-content (http/https) blocking.</p>
  
  <p>I have three subdomains "a", "b" and "c". Only b is available over SSL.</p>
  
  <p>I have a web application with the following frame structure:</p>
  
  <ul>
  <li>Navigate to <a href="http://a.example.com" rel="nofollow">http://a.example.com</a></li>
  <li>Page contains an iframe to another page on <a href="http://a.example.com" rel="nofollow">http://a.example.com</a></li>
  <li>iframe makes ajax request to <a href="https://b.example.com/" rel="nofollow">https://b.example.com/</a></li>
  <li>iframe sets window.location.href to <a href="https://b.example.com/" rel="nofollow">https://b.example.com/</a></li>
  <li>iframe (now on <a href="https://b.example.com/" rel="nofollow">https://b.example.com/</a> ) loads nested iframe to another page on <a href="https://b.example.com/" rel="nofollow">https://b.example.com/</a></li>
  <li>Nested iframe offers an <code>&lt;a href=""&gt;</code> directly to <a href="http://c.example.com/" rel="nofollow">http://c.example.com/</a></li>
  </ul>
  
  <p>The last link is blocked by browser's mixed-content security policy:</p>
  
  <p>Chrome 30: <code>[blocked] The page at https://b.example.com ran insecure content from http://c.example.com.</code></p>
  
  <p>Firefox 23: <code>Blocked loading mixed active content "http://c.example.com/"</code></p>
  
  <p>How can i authorise this direct <code>&lt;a href=""&gt;</code> link to bypass mixed-content security policy?</p>