4 ms·

Now that I think about it, interfaces such as Js fetch should make it an error to use http without explicitly allowing in an option. It seems to easy to make a

Now that I think about it, interfaces such as Js fetch should make it an error to use http without explicitly allowing in an option. It seems to easy to make an error and end up in a situation like the post explains.

smaudet 2y ago
Hmm. I think, perhaps, release versions should need this, without a flag. For testing/prototyping, it is invaluable to turn off all the security to rule out security misconfiguration instead of application error. If your API is non-sensitive/relies on out of band security (like large files with checksums), you may still not want https, so there should be some configuration to turn it off. And for "integrations" like jsdelivr, perhaps https libraries should follow this rule, while http ones can have the flag off... Then, if you mix the two (http and https) perhaps they can provide an noticeable alert to the user rather than failing silently...