7

Accessing per-site metas over HTTPS is officially unsupported and known to be broken (Accessing per-site metas gives 403 forbidden from cloudflare-nginx, Untrusted connection when visiting per-site meta over ssl). Yet, the Meta link in the help menu from the top bar has recently become protocol-relative (i.e. //meta.site.stackexchange.com/), which means it won’t work for people using the regular site over HTTPS.

“help” menu with the link to the meta site highlighted

Other links, such as from the site changer at the top left and from the footer of the mobile site, still explicitly link to http://meta.site.stackexchange.com/.

This is more or less the inverse of Losing HTTPS from SO to Meta, which calls for protocol-relative links so that HTTPS users stay on HTTPS. However, this shouldn’t be done before the per-site metas actually work over HTTPS.

Improve this question
5
  • Honestly, any link, especially to a Stack Exchange site that is located in a post or comment should also be protocol-relative. My biggest pet peeve now is clicking on links, and having to rewrite the url just to get somewhere (and if something redirects, I have to do it twice..).
    – Zizouz212
    Nov 27, 2015 at 19:00
  • 1
    @Zizouz212 not when the link leads to a broken page.
    – Shadow Wizard Is Sad And Angry
    Nov 27, 2015 at 19:00
  • @ShadowWizard ?
    – Zizouz212
    Nov 27, 2015 at 19:01
  • @Zizouz212 you said "any link should be protocol relative", and I replied "not when it leads to broken page", meaning link to per-site meta over https is broken, leading to errors, hence should not be used. They should put link to the non-https meta. (or in other words, I agree with this bug report)
    – Shadow Wizard Is Sad And Angry
    Nov 27, 2015 at 19:02
  • 5
    The counter-argument to that is that we shouldn't be linking to non-https pages on an https page because that is not an expected result. A user on a secure connection expects the connection to remain secure wherever they go, and shouldn't have to look and make sure it's still secure each page load. At least showing them an error page gives them the option of switching to non-https if they so choose.
    – animuson StaffMod
    Nov 27, 2015 at 19:04

0

Reset to default

Browse other questions tagged .