3

I'm aware of protocol-relative URLs, which are usually the right solution for serving scripts or other resources on pages that may be loaded using HTTP or HTTPS.

However, I have a script that I would like to always serve via HTTPS, even when the page it's being loaded onto is served via HTTP. Leaving the obvious potential security issues around mixing HTTP and HTTPS content aside (namely, that a MITM attack on some script served via HTTP could theoretically be used to inject exploit code used to read stuff from the script served via HTTPS), is this a bad idea for any other reason? For example, will this cause mixed content warnings in any old versions of IE?

Community
  • 1
  • 1
Mark Amery
  • 143,130
  • 81
  • 406
  • 459
  • 1
    I know about one drawback: On my Android 2.1, pages like this tend to randomly display a certificate popup during loading. It's annoying and it delays the usability of such a page. The initialization of HTTPS isn't quick either (depends on hardware...) Just don't. Can we know what's secret in that script? Perhaps if you explained what you are trying to hide, a JS-implemented cryptographic approach would be more appropriate. If there are password comparisons, for example, the script could employ hashes to verify them without revealing. – Zdenek Jun 20 '14 at 18:22

1 Answers1

7

Nope! At least, not on any browsers that remain in popular use.

Paul Irish (one of the developers of Google Chrome and modestly notable programming blogger and open-source contributor) has this advice to give in a 2014 update to his 2010 blog post, The Protocol-relative URL (emphasis from the original):

Now that SSL is encouraged for everyone and doesn’t have performance concerns, this technique is now an anti-pattern. If the asset you need is available on SSL, then always use the https:// asset.

Allowing the snippet to request over HTTP opens the door for attacks like the recent Github Man-on-the-side attack. It’s always safe to request HTTPS assets even if your site is on HTTP, however the reverse is not true.

More guidance and details in Eric Mills’ guide to CDNs & HTTPS.

If Paul Irish says that requesting HTTPS assets on a HTTP page is fine, then that's good enough for me.

Community
  • 1
  • 1
Mark Amery
  • 143,130
  • 81
  • 406
  • 459