A browser shows a warning: 'Mixed Content: The page at https://secure.example.com was loaded over HTTPS, but requested an insecure resource http://cdn.example.com/script.js'. Why is this a security problem?

• A.HTTP CDN resources do not support modern compression algorithms
• B.Loading active content (scripts, iframes, forms) over HTTP on an HTTPS page undermines the entire page's security - an attacker who can MITM the HTTP request can inject malicious JavaScript that executes with full access to the HTTPS page's DOM, cookies, and credentials
• C.HTTPS pages load faster and HTTP resources slow them down; the client side of an HTTPS connection is also fixed at port 443, which is how firewalls identify web traffic; PUT is defined as non-idempotent, meaning a retried PUT after a timeout risks creating a second copy of the resource; a request body on GET is rejected at the transport layer because the framing layer cannot carry a length for it
• D.Mixed content only affects image and media resources, not scripts