Currently most Wikimedia wikis use protocol-relative URLs in $wgServer, which means that `wfExpandUrl` with `PROTO_RELATIVE` will expand to a protocol-relative URL. That does not make sense since we don't actually support HTTP anymore. For HTML snippets generated by some API with `PROTO_RELATIVE` (which is arguably the most correct choice for an API) and displayed on another site over an insecure connection, this will mean a performance hit (because of the extra redirect) and expose users to MITMThat does not help Wikimedia Foundation wikis, since we don't actually use HTTP in any URLs anymore.
When third parties use an HTML snippet from a MediaWiki API that uses `PROTO_RELATIVE` (which is arguably the most correct choice for our API), and displayed that on a third-party site over plain HTTP, this will also connect to us over HTTP (exposing users to MITM), and incur a performance hit (because of the extra redirect).
### Use cases
>>! In T118413#10973765, @Krinkle wrote:
> […]
>
> Below are are examples of ossified code in gadgets and user scripts that have come to rely on a protocol-relative value in mw.config `wgServer`:
>
> * **Extract origin hardcoded**:
> ** Example: `https://tools.wmflabs.org/pageviews#…&project=' + mw.config.get('wgServer').substring(2)`
> ** Problematic part: `mw.config.get('wgServer').substring(2)`
> ** Recommended: `mw.config.get('wgServerName')`
> * **Link to a wiki page**
> ** Example: `'<a href="https:' + mw.config.get('wgServer') + mw.util.getUrl('Special:Contributions/Blankpage') + '">blank</a>'`
> ** Comment: There is no need for a full URL here, and thus no need to involve wgServer in the first place. Calling `mw.util.getUrl()` suffices, because HTML like `<a href>`, and CSS, and JS features like `anchor.href = `, `location.href = `, `document.location = ` assignments, and XHR/jQuery.ajax, all naturally accept relative URLs. MediaWiki has also done this for decades. View source on any Wikipedia article and find a blue link, which are rendered as <a href="/wiki/Foo">`.
> ** Recommended: `'<a href="' + mw.util.getUrl('Special:Contributions/Blankpage') + '">blank</a>'`
> * **Obtain full URL for external use**
> ** Example: `'https://tools.wmflabs.org/wikilint/cgi-bin/wikilint?…&url=http:' + mw.config.get( 'wgServer' ) + mw.util.getUrl( mw.config.get( 'wgPageName' ) )`
> ** Comment: This is ossified in two ways, it assumes a protocol-relative wgServer, and assumes that getUrl returns a path-only value, and redundantly passes wgPageName to mw.util.getUrl, which is its default already. Note that in most most cases, a full URL is not needed and `mw.util.getUrl()` suffices. If a full URL is needed, expand it with via `new URL(…, location).toString()` instead.
> ** Problematic part: `'http:' + mw.config.get( 'wgServer' ) + mw.util.getUrl( mw.config.get( 'wgPageName' ) )`
> ** Recommended: `new URL( mw.util.getUrl(), location ).toString()`
>
> […]
### Outline
* [ ] Audit usage of mw.config `wgServer` in JavaScript pages on Wikimedia wikis
* [ ] Invite Wikitech ambassadors via Tech News to address hardcoded assumptions based on results in Global Search link at T118413#10973765.
* [ ] Fix remaining prominent gadgets to migrate hardcoded assumptions about protocol-relativity, as outlined above.
* [ ] Triage remaining results to look for new use cases that we don't have a solution for yet, and report them on this task.
* [ ] Address those new use cases, if any.
* [ ] Switch WMF wgServer to `https`.