4 ms·

If you have absolute URLs (http://..../foo.jpg http://..../foo.jpg) saved in documents or a database or something like that, you would need to rewrite them to b

by regecks 10y ago

If you have absolute URLs (http://..../foo.jpg http://..../foo.jpg) saved in documents or a database or something like that, you would need to rewrite them to be protocol-relative or just https:// https:// .

ReverseCold 10y ago
Hmm, but they said SSL is already enabled if you visit the site with https. Shouldn't redirecting http > https be completely risk free then or am I missing something?
- CharlesW 10y ago
  I think the reply was suggesting that "not advertising or defaulting to [HTTPS]" implies that a quick check for absolute HTTP URLs would be Good Thing.
  - colemickens 10y ago
    Basically every single reply to the GP is making the same point about http assets loaded from a page loaded over https... Surely the GP wouldn't have asked the question they did if their https site was already broken...
- chipperyman573 10y ago
  If you visit a secure site (https), embedding insecure items (http) will fail because they could do just as much damage as loading the entire page over http.
  - Buge 10y ago
    It depends on what the insecure item is. If it's just an image, it won't fail, it will just grey out the https and not display a lock icon. https://mixed.badssl.com/ https://mixed.badssl.com/
    - nailer 10y ago
      That's current behavior, but I wouldn't guarantee it will remain that way, an http image compromises the integrity of the site: it could be manipulated to change the meaning. Imagine reading a news site using an unencrypted CDN and whoever runs the WiFi (or the country you're in) is replacing the images with similar yet different ones, giving a different impression that what the creator intended. You could do this quite subtly as a way to influence people by making certain figures appear more sinister. These warnings tend to get tougher over time, so what's grey now may be red next year.
- rogerdpack 10y ago
  Appears it should be OK unless some inline embedded images are hard coded to "http://" http://" in which case the browser will, I believe, refuse to even try and load them, so you may need to fix that. If they're all relative you're good to go :)
discreditable 10y ago
In the future, the upgrade-insecure-requests CSP directive[1] might help with this problem. I'm not sure what browsers have implemented it yet though. 1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

by regecks 10y ago

ReverseCold 10y ago

Hmm, but they said SSL is already enabled if you visit the site with https. Shouldn't redirecting http > https be completely risk free then or am I missing something?

CharlesW 10y ago
I think the reply was suggesting that "not advertising or defaulting to [HTTPS]" implies that a quick check for absolute HTTP URLs would be Good Thing.
- colemickens 10y ago
  Basically every single reply to the GP is making the same point about http assets loaded from a page loaded over https... Surely the GP wouldn't have asked the question they did if their https site was already broken...
chipperyman573 10y ago
If you visit a secure site (https), embedding insecure items (http) will fail because they could do just as much damage as loading the entire page over http.
- Buge 10y ago
  It depends on what the insecure item is. If it's just an image, it won't fail, it will just grey out the https and not display a lock icon. https://mixed.badssl.com/ https://mixed.badssl.com/
  - nailer 10y ago
    That's current behavior, but I wouldn't guarantee it will remain that way, an http image compromises the integrity of the site: it could be manipulated to change the meaning. Imagine reading a news site using an unencrypted CDN and whoever runs the WiFi (or the country you're in) is replacing the images with similar yet different ones, giving a different impression that what the creator intended. You could do this quite subtly as a way to influence people by making certain figures appear more sinister. These warnings tend to get tougher over time, so what's grey now may be red next year.
rogerdpack 10y ago
Appears it should be OK unless some inline embedded images are hard coded to "http://" http://" in which case the browser will, I believe, refuse to even try and load them, so you may need to fix that. If they're all relative you're good to go :)

discreditable 10y ago

In the future, the upgrade-insecure-requests CSP directive[1] might help with this problem. I'm not sure what browsers have implemented it yet though. 1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...