31

I have seen default to HTTPS links when using Imgur links, https://www.stackoverflow.com redirects to insecure http://stackoverflow.com and HTTPS to Imgur?, but none of them really capture my question, which is:

When I grab the HTML to embed my flair should the links included (both the one to my profile and the one for the image) be given as HTTPS?

I noticed that they were not HTTPS when I embedded my flair on the new blog that I'm starting on GitHub Pages. Since I can access the web page over HTTP or HTTPS, I prefer HTTPS (as arguably everyone should nowadays) and provide links with the HTTPS scheme specified, but when I added my flair the reaffirming lock icon (in my Firefox URL bar) turned into an alarming warning triangle.

After I noticed this issue, I tried to change them to HTTPS and was somewhat surprisingly they worked. Then I immediately thought to myself: Shouldn't this be the default?

Perhaps I am wrong, but it feels as though if it's provided we should use it.

As Deduplicator mentioned below I now believe that the provided URLs should be made protocol relative.

I hate to sound "flip-floppy", but after seeing the comments and answer below, I gave it a ton of though and I'm going back to my original opinion that we should use HTTPS by default.

3
  • 8
    Well, arguably the default should be protocol-relative URLs, as the SE sites all have http and https working good enough, at least for that. Commented Oct 14, 2015 at 1:47
  • Now that you mention that I completely agree. protocol relative URLs would be perfect, I hadn't thought of that.
    – iLoveTux
    Commented Oct 14, 2015 at 1:48
  • 4
    @Deduplicator: Protocol relative URLs are no longer considered best practise, for example, Paul Irish no longer recommends protocol relative URLs and considers it an anti-pattern. Just always use HTTPS.
    – Flimm
    Commented Oct 14, 2015 at 9:10

1 Answer 1

34

Yes, it should be provided over HTTPS.

Using an http:// link breaks when you decide to upgrade your site to HTTPS, and it's insecure.

Using a protocol relative URL // is no longer recommended by people like Paul Irish, because it's vulnerable to a man-on-the-side attack when served in an HTTP page. Nowadays, just always use HTTPS.

4
  • 5
    Nowadays, just always use HTTPS. I wish our clients heeded this advice! :P Commented Oct 16, 2015 at 8:45
  • I wish certificates would be cheaper!
    – deW1
    Commented Oct 16, 2015 at 21:26
  • @deW1 Certificates from Let's Encrypt are free.
    – Flimm
    Commented Apr 15, 2016 at 10:31
  • @Flimm you're amazing thank you :)
    – deW1
    Commented Apr 15, 2016 at 11:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .