Nowadays most sites redirect HTTP traffic to HTTPS for requests to their pages. However the same can't be said for assets (images, js, css). Most of the assets are available under both HTTP and HTTPS. Is there any particular reason that access to assets via HTTP is not redirected as is the case with the requests to pages? Why not force HTTPS everywhere?
2 Answers
It is true that the assets within HTTPS web pages should also be served through HTTPS but there are reasons to not try to force the web server to push every request to HTTPS for all incoming HTTP requests for that domain but continue to allow HTTP access.
- As a failsafe for https configuration mishaps
- To support clients that don't have https support
- Prefer to leave the enforcement of the HTTPS for assets within HTML served over HTTPS to the Application Layer and don't try to enforce at the Server Configuration Layer
This question confronts people when running the Certbot/Let's Encrypt tools for creating Free HTTPS SSL Certificates and configuring the Nginx or Apache Web Server. The Web Servers provide mechanisms to force clients that request http to redirect to the https version.
For general use it's probably safest and simplest to allow redirect to https and forced to use https. Just keep in mind that there are cases that may require deviating from this default.
-
Thank you. The strongest reason from your list to me is "To support clients that don't have https support" – but do you actually have any known examples of where and how this may happen? Why would I want my CSS, JS and images be available over HTTP and not be forced over to HTTPS? Who would want them over HTTP? Oct 8, 2018 at 9:48
-
1I think it's broader than just your web html page. You could be using the server to allow a service to access txt log files for example on the same domain. Maybe I want a command line cron job to pull these files every day onto a server but don't want to install the SSL libraries for the curl or client tool I'm using or I just don't want to create the additional client/server load of the encryption for no reason. Web servers and domains have a usage that can extent beyond your HTML pages - though if that is your scope then it would make sense to redirect to https. Oct 9, 2018 at 1:31
-
1Also don't underestimate the value in having a fallback for https issues. If a major browser suddenly drops support for your SSL service configuration this can impact users and force remedial action by a sysadmin but if you have http to fallback on then you simply redirect users to the http link .. of course this assumes nothing is happening in the communication conversation that really should be encrypted. No doubt over time SSL will continue to become enforced in more places but until it's universal there are use cases for supporting unencrypted HTTP. Oct 9, 2018 at 1:36
Assets should not be included/referenced in HTTPS pages via HTTP at all. Or rephrased:
If you build a website which is loaded via HTTPS all its content has to be loaded via HTTPS as well. This includes CSS, JS, images and the like and even remote content not on the same domain.
If this was not the case any modern browser would inform the user about the website not being secure due to using mixed content.
Website providers might consider not enforcing the switch from HTTP to HTTPS on those elements when loaded on their own. This might be to have a fallback and not enforce users that use the website with HTTP from the beginning to load the assets via HTTPS.
Though I don't see how this might happen, as all users getting the website via HTTP are redirected to HTTPS. Anyway ... strange decision was made, probably during the early phase of HTTPS adoption and they might have stuck to this odd decision.
-
Thank you. But it seems like this "strange" decision is made by all major websites. All of their assets are available through HTTP and HTTPS, yet their website itself is available only through HTTPS. Why would they do that? Oct 8, 2018 at 9:50
-
Can you give me an example of those sites? Never noticed it myself. Oct 8, 2018 at 18:14
-
Try to curl any Facebook, Google, stackoverflow asset through HTTP – you won't be redirected. Oct 8, 2018 at 19:46
-
You are right. www.google.com is also available via http if you use curl. Chrome itself redirects via internal 307 to the https variant. When using Firefox it gets a 302 from the server. Seems to depend on the UserAgent. Oct 9, 2018 at 20:08