4 ms·
At any large media organization, there are tremendous amounts of content no longer connected to any CMS that may have hard-coded insecure links/resources in the
by justinph 10y ago
At any large media organization, there are tremendous amounts of content no longer connected to any CMS that may have hard-coded insecure links/resources in them. Some of them may live on obscure servers or domains. Or the developers/journalists who worked on them and have knowledge of their construction are long gone. These pages are very laborious to find and update.
If you don't mind 404ing or breaking a ton of your old content, it's probably not too difficult. But if you're the newspaper of record, it's a big deal that URLs live on and continue to work as expected.
- kelnos 10y agoYou also mention "insecure resources", wich I think is a big deal too. I'd imagine there'd be the oddA hard-coded http link to an image that serves an important purpose to an article... that suddenly going missing because a browser refuses to load it would be bad. But I think you hit the nail on the head -- being the "newspaper of record" means you want to ensure that all your content displays like it did the day it was published.
- fjdlwlv 10y agoHTTP URLs redirect to HTTPS
- yvan 10y agoWell, in our case that was the easiest thing to pick, thanks to the Report-Only option on the CSP header, we enabled it and in about a week, we got all our insecure links and resources. We could also set a header forcing the browser to upgrade to secure when the resources are in the same domain.
- fjdlwlv 10y agoHTTP URLs redirect to HTTPS, done. That's a basic step of turning on HTTPS