5 ms·
To be fair, doing it client side like this is so much easier than setting up all the rewrite rules server side. It's actually kind of funny he chose the least c
by ArlenBales 5y ago
To be fair, doing it client side like this is so much easier than setting up all the rewrite rules server side. It's actually kind of funny he chose the least complex route here considering everything else about his site is overly complicated.
- 5e92cb50239222b 5y agoWhat rewrite rules? Caddy does it for you automatically. With nginx it's a single line in the config file. Or throw your site into HSTS preload (ok, you'll have to add a single header to the config) and any modern browser won't even try HTTP. There are multiple solutions and all of them are even simpler than what he picked.
- Macha 5y agoThe point of redirecting to HTTPS is so someone cannot MITM your traffic. HSTS ensures there's only one chance for that to happen as your browser will remember the HTTPS redirect. This kind of redirect does not provide the same benefit. An attacker could just tamper with the JS to remove that code, and this could happen on any visit, not just the first.
- fullstackchris 5y agoThis is a one liner in NGINX...
- Anthony-G 5y agoTo add to the sibling comments (not downvoting): if you have a HTTP site served by Apache and use the Apache plugin for certbot to obtain a Let’s Encrypt-signed certificate, certbot also does a good job generating the Apache configuration to enable redirects to the HTTPS version.
- manigandham 5y agoThis should be done server-side and is a single line with most frameworks or web servers. It actually highlights the central issue here being frontend devs and practices trying to reach into the backend without any experience or knowledge, resulting in an over-complicated mess while solving no real problems.