企业HTTP转HTTPS：能否用ChromeDriver检测HTTPS页面安全状态？

Absolutely! You can absolutely replicate the manual Chrome console checks for HTTPS security status and non-secure elements using ChromeDriver with Java—here's a practical, step-by-step guide to make it happen:

Chrome's DevTools Protocol (CDP) lets you directly pull the same security state information you see in the browser's "Security" tab. Here's how to implement this in Java:

import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.devtools.DevTools;
import org.openqa.selenium.devtools.v120.security.Security;
import org.openqa.selenium.devtools.v120.security.model.SecurityState;

public class HttpsSecurityChecker {
    public static void main(String[] args) {
        // Set ChromeDriver path (ensure version matches your installed Chrome!)
        System.setProperty("webdriver.chrome.driver", "/path/to/your/chromedriver");
        ChromeDriver driver = new ChromeDriver();
        
        // Enable DevTools session
        DevTools devTools = driver.getDevTools();
        devTools.createSession();
        
        // Navigate to your target HTTPS URL
        driver.get("https://your-test-url.com");
        
        // Fetch security state (matches what's shown in Chrome's Security tab)
        Security.GetSecurityStateResponse securityData = devTools.send(Security.getSecurityState());
        SecurityState pageSecurityState = securityData.getSecurityState();
        String mixedContentStatus = securityData.getMixedContentStatus().toString();
        
        // Print results
        System.out.println("Page Security State: " + pageSecurityState);
        System.out.println("Mixed Content Status: " + mixedContentStatus);
        
        driver.quit();
    }
}

This will return states like:

• SECURE: Corresponding to the green lock icon
• WARNING: Yellow exclamation (e.g., mixed content present)
• INSECURE: Red "not secure" label

The mixedContentStatus will tell you if non-secure content was displayed (CONTENT_DISPLAYED), blocked by the browser (CONTENT_BLOCKED), or if there's no mixed content at all (NONE).

To find exactly which elements (images, scripts, stylesheets, etc.) are loading over HTTP (breaking the green lock), you can use CDP's Network domain to capture and filter requests:

import org.openqa.selenium.chrome.ChromeDriver;
import org.openqa.selenium.devtools.DevTools;
import org.openqa.selenium.devtools.v120.network.Network;
import org.openqa.selenium.devtools.v120.network.model.Request;

import java.util.ArrayList;
import java.util.List;

public class MixedContentDetector {
    public static void main(String[] args) {
        System.setProperty("webdriver.chrome.driver", "/path/to/your/chromedriver");
        ChromeDriver driver = new ChromeDriver();
        DevTools devTools = driver.getDevTools();
        devTools.createSession();
        
        // Enable network request monitoring
        devTools.send(Network.enable(null, null, null));
        
        List<Request> insecureRequests = new ArrayList<>();
        
        // Listen for all outgoing requests and filter non-secure ones
        devTools.addListener(Network.requestWillBeSent(), requestEvent -> {
            Request request = requestEvent.getRequest();
            String requestUrl = request.getUrl();
            
            // Capture HTTP requests (non-secure)
            if (requestUrl.startsWith("http://")) {
                insecureRequests.add(request);
                System.out.println("Non-secure request found: " + requestUrl);
                System.out.println("Initiated by: " + requestEvent.getInitiator().getType());
            }
        });
        
        // Load the target URL
        driver.get("https://your-test-url.com");
        
        // After page load, summarize results
        System.out.println("\nTotal non-secure requests detected: " + insecureRequests.size());
        
        driver.quit();
    }
}

This works just like manually filtering the "Network" tab for HTTP requests—you'll see exactly which resources are causing the security issue, plus their initiator type (e.g., script, img, stylesheet) to help you locate the problematic element in your code.

If you need to replicate the certificate details shown in the "Security" tab, you can use CDP's Security.getVisibleSecurityState() method to fetch things like certificate validity, issuer, and more—perfect for deep-dive troubleshooting.

Since you're reading URLs from a local text file:

• Wrap the above logic in a loop that reads each URL from your file
• Add waits (like WebDriverWait) to account for dynamic content loading
• Log results to a report (CSV, text file) for easy review later
• Always ensure your ChromeDriver version matches your installed Chrome browser—mismatches cause CDP compatibility issues

内容的提问来源于stack exchange，提问作者DK1967