3 ms·
IE. But that is soon over. You should see SSL from Google though.
by jbk 9y ago
IE. But that is soon over.
You should see SSL from Google though.
- sleepless 9y agoIs there an existing ticket for redirects?
- jbk 9y agoYes. But not in the VLC tracker, because it is not a VLC issue.
- Hello71 9y agohttps://www.w3.org/TR/upgrade-insecure-requests/#feature-detect https://www.w3.org/TR/upgrade-insecure-requests/#feature-det...
- pilif 9y agoBecause of lacking SNI support? You can try an Ajax request or loading a picture over SSL and then redirect with JS if it doesn't fail. If the SSL site serves HSTS headers, all SNI supporting browsers will in the future default to HTTPS independently of the kludgey redirect (because all browsers that support HSTS also support SNI). Sure. An unconditional redirect would be better, but that requires a dedicated IP
- jbk 9y agoGood idea.
- toast0 9y agoYou can also set the favicon path to https, and put hsts headers on it. No JavaScript required.
- pilif 9y agoBut people with old IE won’t get a favicon that way
- talklittle 9y ago> You can try an Ajax request or loading a picture over SSL and then redirect with JS if it doesn't fail. Neat idea, but wouldn't this still be exposed to ISP-level attacks? Since the user is still loading the page initially in plain HTTP, so the ISP could still inject code, remove the JS redirect, etc.
- icebraining 9y agoYes, no redirect can protect the user from that. In fact, not even completely disabling HTTP can - the ISP can respond on port 80 anyway. But it can protect them if they open it on a safe connection and then bookmark the page, or keep the tab open, or send the link to someone else, and then use that link on an unsafe connection.
- finnn 9y agoOr using HSTS (especially with HSTS preloading)