Bug 175685

Summary:	HTTPS does not follow visitor among FreeBSD.org sub-domains
Product:	Documentation	Reporter:	John W. O'Brien <john>
Component:	Books & Articles	Assignee:	Wolfram Schneider <wosch>
Status:	Closed FIXED
Severity:	Affects Only Me	CC:	wosch
Priority:	Normal
Version:	Latest
Hardware:	Any
OS:	Any

Description John W. O'Brien 2013-01-29 22:20:00 UTC

Thanks to the new SSL/TLS certificates for HTTPS on www.FreeBSD.org,
wiki.FreeBSD.org, svnweb.FreeBSD.org, and lists.FreeBSD.org (as noted in https://lists.freebsd.org/pipermail/freebsd-announce/2013-January/001452.html), visitors can enjoy improved security therein. However, links from one sub-domain to another, and in some cases within a given site, revert to unsecured HTTP.

In addition to the "How to repeat..." examples below, some other affected links I know of include: mirror selection, security advisories and errata notices, on the home page; "View or search problem reports" from Bug Reports; "browse" link from the mailing lists page, and then from a listinfo page to the associated archives; embedded man page references from all over (e.g. the Handbook); and submitting this very form.

How-To-Repeat: - Browse to https://www.freebsd.org/
- Do one of the following:
-- Use the search tool
-- Navigate using the main menus to Documentation->Manual Pages
-- ... Community->Forums
-- ... Developers->*
-- ... Support->Security Information
-- ... Support->Bug Reports
-- Etc

Comment 1 Remko Lodder freebsd_committer

2014-02-24 11:48:26 UTC

Responsible Changed
From-To: freebsd-www->freebsd-doc

redirect to doc, also, should we make links on the htdocs/ frontend 
just mention the /location.file instead of http://www.freebsd.org/ 
so that this behaviour is no longer seen?

Comment 2 Allan Jude 2014-02-24 18:25:42 UTC

Another method that has become common in recent years is

<a href="//www.freebsd.org/blah/blah">

Which will keep the current protocol, be that HTTP or HTTPS

Although I am not sure how some of the more basic browsers like lynx
might handle that. Google et all use it for including javascript to
avoid 'mixed content'.


-- 
Allan Jude

Comment 3 John W. O'Brien 2017-04-06 23:04:07 UTC

How can I help move this along?

Comment 4 Wolfram Schneider freebsd_committer

2017-10-06 13:29:05 UTC

So far, all the links mentions in this report are using now HTTPS. Lets close it.