16

This question already has an answer here:

Stack Overflow seems to work through HTTPS connection, but the custom avatars (uploaded files, not those from gravatar) are even then fetched from http://i.stack.imgur.com/ using standard http connections (which generates warning in browsers and is not a very good practice). As those images are also available through HTTPS it could be just a service misconfiguration.

Is there a technical (or any other) reason why they couldn't be fetched using HTTPS?

marked as duplicate by Shadow Wizard, hims056, Martijn Pieters, ben is uǝq backwards, Aziz Shaikh Jan 14 '14 at 14:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Screenshot for confirmation (I use a custom avatar): i.stack.imgur.com/M4opG.png – doppelgreener Jan 13 '14 at 23:22
  • Looks like they just store the absolute URL of the picture in the database, see that gravatar based pictures always use https even when browsing the non secure site. – Shadow Wizard Jan 13 '14 at 23:43
  • 1
    SSL support is planned/in progress, and still not officially supported. This is one of the items on our TODO list. – m0sa Jan 14 '14 at 8:42
  • @m0sa so isn't this a dupe of that one? (when it will be completed, this one will too) – Shadow Wizard Jan 14 '14 at 8:47
  • @ShadowWizard it's a part of it, I guess we might as well close it as a dupe.. – m0sa Jan 14 '14 at 8:50
  • Added my meager vote. :) – Shadow Wizard Jan 14 '14 at 8:52
  • @M0sa, I have seen that issue, but it is about access through SSL to Stack Exchange sites in general. There are two issues mentioned, the second one may be in fact the same, but there are no details and it is not known what content it is about. My question/report is about a concrete content - uploaded profile pictures and as they are already available also through HTTPS it could a misconfiguration or just an overlook which possibly could be easily fixed (it is not the same as the need to make some external resources available via HTTPS when they are served only via HTTP). – Szpak Jan 14 '14 at 9:49