title: Uncaught SecurityError: Failed to construct 'WebSocket': An insecure WebSocket connection may not be initiated from a page loaded over HTTPS
body: <p>I am using GlassFish Server 4.1/Java EE 7. In my web.xml file, I mentioned the following security constraints.</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;security-constraint&gt;
      &lt;display-name&gt;UserConstraint&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Provide a Name&lt;/web-resource-name&gt;
          &lt;description/&gt;
          &lt;url-pattern&gt;/admin_side/*&lt;/url-pattern&gt;
          &lt;http-method&gt;GET&lt;/http-method&gt;
          &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;description/&gt;
          &lt;role-name&gt;ROLE_ADMIN&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
      &lt;user-data-constraint&gt;
          &lt;description/&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>And the same for other authorities.</p>
  
  <p>Since <code>transport-guarantee</code> is set to <code>CONFIDENTIAL</code>, web pages that match the specified URL pattern <code>/admin_side/*</code> run over a secure channel (<code>HTTPS</code>).</p>
  
  <p>While using WebSockets as follows (JavaScript),</p>
  
  <pre><code>var ws = new WebSocket("ws://localhost:8181/Context/Push");
  </code></pre>
  
  <p>it fails to establish an initial handshake. The browser shows the following warning on the browser console.</p>
  
  <pre><code>[blocked] The page at 'https://localhost:8181/Context/admin_side/Category' was loaded over HTTPS, but ran insecure content from 'ws://localhost:8080/Context/Push': this content should also be loaded over HTTPS.
  
  Uncaught SecurityError: Failed to construct 'WebSocket': An insecure WebSocket connection may not be initiated from a page loaded over HTTPS.
  </code></pre>
  
  <p>When the <code>&lt;user-data-constraint&gt;</code> section from web.xml is removed in its entirely, web pages run on <code>HTTP</code>. After that, changing,</p>
  
  <pre><code>var ws = new WebSocket("ws://localhost:8181/Context/Push");
  </code></pre>
  
  <p>to </p>
  
  <pre><code>var ws = new WebSocket("ws://localhost:8080/Context/Push");
  </code></pre>
  
  <p>works fine.</p>
  
  <p>What might be done to make WebSockets work over a secure channel?</p>