5

For me at least, partial SSL support with mixed content has been working for a long time. I'm aware that the SSL rollout is a slow process, but whenever I'm connected without an ‘s’ after the ‘http’, I do not want to be logged-in. Whenever I make sure that the URL starts with ‘https://’, only then I should be logged-in. This is possible. Wikipedia, for example, has a similar behaviour – if I log-in over SSL I will not be logged-in on pages viewed without SSL, and vice versa. My suggestion is to do that except that logging-in without SSL will also log-in with SSL and with the opt-out, only SSL can be logged-in.
    That said, it would also be nice to fix the bugs that prevent Stack Exchange from being protocol relative, to make it easier to not loose HTTPS and appear logged-out:

Indeed, this can be done with client-side tools such as HTTPS Everywhere so is not as important as this feature request.
    Nevertheless, if you provide an option to opt-out of being logged-in whenever I accidentally loose SSL, I don't really care how long it takes you to complete the rollout. I don't mind things like the meta.*.stackexchange.com errors because if the certificate is valid for *.stackexchange.com I don't know what the heck security issue my browser is complaining about and just add an exception. But it's fine that “HTTPS (SSL) is not officially supported” as long as that translates to ‘being logged-in is not officially supported’ for those who opt-out of insecure log-in.

  • This will happen for everyone as part of secure-only cookies in the near future. Marking it as status-planned. – Nick Craver May 22 '17 at 17:32

You must log in to answer this question.

Browse other questions tagged .