Hacker News Reader

Comment by regecks | Hacker News Reader

If you have absolute URLs (http://..../foo.jpg) saved in documents or a database or something like that, you would need to rewrite them to be protocol-relative or just https:// .

View on HN

Hmm, but they said SSL is already enabled if you visit the site with https. Shouldn't redirecting http > https be completely risk free then or am I missing something?

I think the reply was suggesting that "not advertising or defaulting to [HTTPS]" implies that a quick check for absolute HTTP URLs would be Good Thing.

Basically every single reply to the GP is making the same point about http assets loaded from a page loaded over https...

Surely the GP wouldn't have asked the question they did if their https site was already broken...

If you visit a secure site (https), embedding insecure items (http) will fail because they could do just as much damage as loading the entire page over http.

It depends on what the insecure item is. If it's just an image, it won't fail, it will just grey out the https and not display a lock icon.

https://mixed.badssl.com/

That's current behavior, but I wouldn't guarantee it will remain that way, an http image compromises the integrity of the site: it could be manipulated to change the meaning. Imagine reading a news site using an unencrypted CDN and whoever runs the WiFi (or the country you're in) is replacing the images with similar yet different ones, giving a different impression that what the creator intended.

You could do this quite subtly as a way to influence people by making certain figures appear more sinister.

These warnings tend to get tougher over time, so what's grey now may be red next year.

Appears it should be OK unless some inline embedded images are hard coded to "http://" in which case the browser will, I believe, refuse to even try and load them, so you may need to fix that. If they're all relative you're good to go :)

In the future, the upgrade-insecure-requests CSP directive[1] might help with this problem. I'm not sure what browsers have implemented it yet though.

1. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

Reply on news.ycombinator.com