Decide if we should include a protocol in achor hrefs

[juliandoucette]

Background

We have been using http://, https://, and // inconsistently.

What to change

• Investigate which is appropriate when
• Document this in our code style guide

[saroyanm]

I'm not entirely sure what are you suggesting, but if you will not mention the protocol there is a risk that browser can consider the link as a relative.
My suggestion is to use secure version if applicable and the protocol settings is something that is defined not on our end if it's 3-rd party website.

[ire]

@saroyanm: I believe what Julian is referring to is the protocol-relative URL, where, if the http:/https: is not written, the browser chooses which to use depending on the protocol of the page requesting the asset. Not to be confused with the single forward slash (/) which defines a relative url on the same domain.

@juliandoucette: From the research I've done, it seems to be advised that the protocol always be stated. Particularly if the resource has a https:// version, then that should always be fetched for security reasons. See this quote:

Now that SSL is encouraged for everyone and doesn’t have performance concerns, this technique [the protocol-relative URL] is now an anti-pattern. If the asset you need is available on SSL, then always use the ​https:// asset.

Allowing the snippet to request over HTTP opens the door for attacks like the recent Github Man-on-the-side attack. It’s always safe to request HTTPS assets even if your site is on HTTP, however the reverse is not true.

(​Paul Irish, The protocol-relative URL)

Other references:

• ​https://jeremywagner.me/blog/stop-using-the-protocol-relative-url
• ​https://github.com/konklone/cdns-to-https#conclusion-cdns-should-redirect-to-https
• ​https://www.digitalgov.gov/2015/08/14/secure-central-hosting-for-the-digital-analytics-program/

Based on this, I think we should always define the protocol.

[juliandoucette]

@Vasily and/or @Jon can you please review comment 3 and provide your opinion on this matter (as it is relevant to how our CMS functions).

[juliandoucette]

I think Ire's answer was sufficient to resolve this issue. Documentation will follow in a separate issue.