Page MenuHomePhabricator

protocol relative urls do not have "secure" pad-lock icon when browsing from https and are thus secure links
Closed, ResolvedPublic

Description

Author: it_is_me_here

Description:
On the English Wikipedia, at least, if you type something like "[//en.wikipedia.org/w/index.php?title=Main_Page&oldid=464887589]" and are yourself browsing the site through https://en.wikipedia.org, then the external link will show up with a normal EL symbol (a square with an arrow leaving it), rather than with an HTTPS EL symbol (a padlock), even though the link will direct you to an HTTPS URL.


Version: 1.18.x
Severity: minor
OS: Windows 7
Platform: PC

Details

Reference
bz33269

Event Timeline

bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 12:01 AM
bzimport set Reference to bz33269.
bzimport added a subscriber: Unknown Object (MLST).

Hmmm.

Those padlock icons are done through css like a.external[href^="https://"] which won't trigger for protocol relative.

Not sure if its possible to serve some css only to secure folks with a a.external[href^="//"] type rule. It seems like that would conflict with the whole one version of things regardless of protocol.

(In reply to comment #1)

Hmmm.

Those padlock icons are done through css like a.external[href^="https://"]
which won't trigger for protocol relative.

Not sure if its possible to serve some css only to secure folks with a
a.external[href^="//"] type rule. It seems like that would conflict with the
whole one version of things regardless of protocol.

I don't believe this is possible, no. This is a duplicate of another bug but I can't find it offhand.

  • This bug has been marked as a duplicate of bug 30682 ***