Viewing stackoverflow.com HTTPS and clicking on a notification link for the meta site changes from HTTPS to HTTP. The sites should remain in whatever protocol the user is currently using when switching from site to site.

  • The problem with meta sites and SSL is nontrivial, see meta.stackexchange.com/q/216035/189097 – miniBill Feb 28 '14 at 8:47
  • 3
    @miniBill: True, but this problem is a trivial one: the links in the notification menus just need to lose the http: prefix to become protocol-relative. In the mean time, HTTPS Everywhere should serve as a work-around. – Ilmari Karonen Feb 28 '14 at 12:13

This is not a bug, HTTPS support outside of login is not supported yet. We have to solve the drastic performance problems that HTTPS brings before opening the gates on that one - which we're close to being able to do. Then, we'll address the mixed content issues - but those don't matter if we can't get it to perform decently, so they come second on the priority list.

When we enable HTTPS, we'll do so via HSTS for navigation. This will give you the option of security given the performance difference inherent in the handshakes needed for TLS.

  • 2
    It is a bug, even if it's currently status-deferred: those HTTP links in the inbox / achievements menus will, sooner or later, need to lose the http: and become protocol-relative. – Ilmari Karonen Feb 28 '14 at 12:15
  • 3
    @IlmariKaronen A bug is something behaving in a way it was not designed to; they are currently working exactly as they are supposed to. They don't need to become protocol-relative, they only need to if we enable HTTPS, which we haven't done, and are a ways from doing. You're browsing a URL we never linked you to, don't blame us if it's not 100% ready to go yet. Trust me when I say there are many issues with enabling HTTPS that haven't even begun to be mentioned here on meta (and post-date my blog post). – Nick Craver Feb 28 '14 at 12:22
  • Fair enough. I suppose I was assuming that eventual working HTTPS support was a goal Stack Exchange was committed to, even if the timetable was still open. – Ilmari Karonen Feb 28 '14 at 12:25
  • @IlmariKaronen it is, it's just far more complicated that most people realize. I guess it's time for a followup blog post detailing many more issues/hurdles with deploying SSL/TLS correctly for our sites. – Nick Craver Feb 28 '14 at 12:27
  • 2
    That would be nice. (I do understand that it's complicated, and, frankly, I'm impressed that the "alpha" support we already have works as well as it does, despite the occasional missing bits. I've tried to do my small part to help things along by noting little issues like this one, that can be worked around on the client side, and adding the workarounds to SOUP.) – Ilmari Karonen Feb 28 '14 at 12:30
  • istlsfastyet.com – Amelia Jul 17 '15 at 10:26

HTTPS support for child meta sites was completed on March 16th, 2017 as part of the network-wide rollout of HTTPS. This change included using HTTPS URLs for notifications.

HTTPS Notifications

Not the answer you're looking for? Browse other questions tagged .