Ticket Change Details
Not logged in
Overview

Artifact ID: 1ebb65da8904a5e8fb04af0dad60d2bac2cb20ea
Ticket: 0ffa37e70e885cfc5c86d2546e51480c83b819b0
There is currently no way to enforce 100% use of SSL
User & Date: dmitry 2011-01-18 18:29:28
Changes

  1. Appended to comment:
    
    
    <hr /><i>dmitry added on 2011-01-18 18:29:28 UTC:</i><br />
    I see, thanks for explanation (I forgot about the actual data sent to webserver, and thought redirects would handle this).
    
    I think the fix for this would be to change "http://" everywhere in fossil's code which generates webpages to just "//", so that it prints them like this:
    
    <pre>
    <form method="post" action="http://fossil.some.site/Fossil-Repository/wikinew">
    </pre>
    
    <pre>
    <form method="post" action="//fossil.some.site/Fossil-Repository/wikinew">
    </pre>
    
    This will use whatever protocol (http or https) this page were originally, and yes, this is in RFC, and supported by all browsers.
    
    Even better, though harder, would be making all links relative.