All internal links on Stack Exchange sites should be protocol-relative

Question

In preparation for the eventual deployment of full HTTPS support on Stack Exchange, and also to make the currently available "alpha" HTTPS support more usable, all links from Stack Exchange sites to other Stack Exchange sites should be protocol-relative.

Currently, at least the following places still feature links with explicit http: protocol prefixes:

• the page footer,
• the "Hot Network Questions" and "Community Bulletin" modules in the sidebar,
• the "inbox" and "achievements" menus in the top bar (the site switcher menu is OK, though),

and, of course,

• lots and lots of user-supplied links in post and comment content.

I've posted this feature request with the intent to provide a single central place for tracking these issues, rather than having them scattered across multiple meta threads. If you find more places on SE where protocol-relative links should be used, please report them below.

I fully expect this request, in its full sense, to be treated as status-deferred for the time being; however, these issues do need to be fixed at some point before our HTTPS support is ready for "prime time".

Ps. Yes, the next release of SOUP (v1.10) is going to include a general client-side fix for most of these issues. In the mean time, the HTTPS Everywhere plugin effectively provides the same functionality, and much more besides.

Answer 1

So I'm going to status-declined this, but for good reason: we're making everything HTTPS this month. You can read more about it here: Network-wide HTTPS: It's time

Answer 2

Site switcher on https://stackexchange.com is not protocol-relative

Links to other Stack Exchange sites in Site Switcher is protocol-relative when we are on a particular SE site or on MSE. But when we are specifically on https://stackexchange.com/ the site switcher links to the http version of all the sites. The links over there should also be protocol relative.

Answer 3

As planned, version 1.10 of the Stack Overflow Unofficial Patch now contains a client-side implementation of this feature.

Specifically, it works by finding all links on the page that use the http: protocol and point to a Stack Exchange site, and rewriting them to use https: instead.

Some notes about the implementation:

• This feature is only enabled if you're already looking at the page over HTTPS. It will not force you to use HTTPS if you don't want to. (Also, if you accidentally switch to plain HTTP, SOUP will not alert you or redirect you to HTTPS. If you want that, use HTTPS Everywhere.)

• Links to chat, Area 51 and the SE blog are currently excluded, since those sites still load much of their JS and CSS over HTTP, and thus work very poorly, if at all, over HTTPS.

• SOUP does not run on non-SE sites, and thus cannot rewrite links to SE from other sites. Also, if you're, say, using SE chat over plain HTTP, any links there will not get rewritten.

• Obviously, the rewrite also does not apply to things that are not ordinary links, such as form actions or JavaScript pseudo-links. Fortunately, most of those seem to be using relative URLs already.

• To work around a known bug with permalink URLs, any such URLs are rewritten to a slightly longer form (/q/ and /a/ become /questions/, and /u/ becomes /users/). This fix is currently only applied to permalink URLs that use the http: protocol; any permalink URLs already using the https: protocol (or no protocol at all) will not be fixed, and so will redirect you to an HTTP URL if followed.

• For the curious, the code of the user script includes the following line:

  //css:  "a.soup-https-fixed:not(#specificity-hack) { color: green !important }", // uncomment to highlight affected links
  

  Uncommenting it (by removing the // in front of css:) causes all rewritten links to be colored green. You can also achieve the same effect by installing the CSS rule shown on the line as a user style.

In general, this feature of SOUP should not be considered an adequate replacement for HTTPS Everywhere; even with the URL rewrites, it's still all too easy to accidentally switch from HTTPS to plain insecure HTTP. Still, if you just want to occasionally try using Stack Exchange over HTTPS (e.g. to see how well / badly it works), this fix does make it a lot easier to stay in HTTPS mode.

Note (December 2015): As of SOUP v1.42, this fix is no longer applied to links to per-site metas (meta.*.stackechange.com), since, alas, those don't currently work over HTTPS. Hopefully, we'll eventually get proper support for HTTPS on meta sites again, but until then, this part of the fix was doing more harm than good.

Answer 4

Hot Network Questions is still explicitly HTTP

Extract from the end of "Related" and start of "Hot Network Qs":

<div class="spacer js-gps-track">
<a href="https://meta.stackexchange.com/q/270074?rq=1" title="Vote score (upvotes - downvotes)">
    <div class="answer-votes default">6
    </div>
</a><a href="https://meta.stackexchange.com/questions/270074/broken-links-to-per-site-metas?rq=1" class="question-hyperlink">Broken links to per-site metas</a>
</div>

                    </div>
                </div>

<div id="hot-network-questions" class="module">
    <h4>
        <a href="//stackexchange.com/questions?tab=hot" class="js-gps-track" data-gps-track="posts_hot_network.click({ item_type:1, location:11 })">
            Hot Network Questions
        </a>
    </h4>
    <ul>
            <li>
                <div class="favicon favicon-rpg" title="Role-playing Games Stack Exchange"></div><a href="http://rpg.stackexchange.com/questions/76958/what-is-the-probability-of-surviving-my-death-saves" class="js-gps-track" data-gps-track="site.switch({ item_type:11, target_site:122 }); posts_hot_network.click({ item_type:2, location:11 })">
                    What is the probability of surviving my death saves?
                </a>

            </li>

Only the "Hot Network Questions" link itself (in the H4) is protocol-relative. The actual question links are explicitly HTTP.

Interestingly, the related-question links seem to be explicitly HTTPS!

Answer 5

I just noticed that trying to go from https://emacs.stackexchange.com/questions to Help > Meta (which gives this URL: https://emacs.meta.stackexchange.com/), I get this (using Google Chrome). This did not happen before. (Dunno how much this is related to the question here - hope it is.)