3 ms·

How about another question: why doesn't your site redirect http to https?? I'll see myself out... Cool article! Its crazy to me that back in the day schematic

• kens 6y ago
  > why doesn't your site redirect http to https My site is a mess with the blog hosted by Blogger, images stored on AWS, and other files elsewhere, and Cloudflare thrown on top. It was a considerable effort to get https to work at all. I tried a Blogger option to force https and it broke everything for a day so I'm hesitant to try again. I figure that people can go to https directly if it's important to them.
  • toast0 6y ago
    If you can serve HTTP-Strict-Transport-Security (HSTS) headers on https, you can maybe set your favicon to load via https? It's not a redirect, but a modern browser will load everything from https after that. (Until the hsts header expires)
  • a1369209993 6y ago
    > > why doesn't your site redirect http to https Please don't; if we want https, we can[1] do that redirection on the browser side; doing it on the server side means your site doesn't work[0] with user agents that don't include whatever random cryptographic code your site has decided to make de-facto mandatory. > I figure that people can go to https directly if it's important to them. Exactly, thank you. 0: because `GET /whatever` no longer returns a http response body; the fact that the status code is 3xx rather than 200 OK or the presence of a Location header isn't directly relevant. 1: Obviously it's good to support https in addition to http; it's not supporting http that's a problem.