4 ms·
I noticed in Cloudflare you are given the option of allowing the site to have both http and https, and the visitor to the site gets to decide what version they
by jermier 6y ago
I noticed in Cloudflare you are given the option of allowing the site to have both http and https, and the visitor to the site gets to decide what version they want. But what use case does this have other than allowing requests to be downgraded by determined actors?
- cj 6y agoIf you’re providing a service like Rollbar, Bugsnag, Optimizely, etc which are scripts embedded on customer pages, with XHR api requests, it is sometimes necessary for the client to connect via http if you need to support certain IE versions. For example; there are certain versions of IE that will throw an insecure content warning if you load https scripts within a http page. And of course, many older clients don’t (and never will) support newer versions of TLS.
- jermier 6y ago> For example; there are certain versions of IE that will throw an insecure content warning if you load https scripts within a http page. Does IE support 'schemeless URIs'? like: //example.com/resource.js
- ancarda 6y ago>warning if you load https scripts within a http page Why? I get https->http, but why would an upgrade cause a warning?
- null_deref 6y agoI can think about one use case, while developing a website right before buying a certificate for your website, you may want to see how your website will behave at a production environment.