Hacker News Reader

Comment by jermier | Hacker News Reader

I noticed in Cloudflare you are given the option of allowing the site to have both http and https, and the visitor to the site gets to decide what version they want. But what use case does this have other than allowing requests to be downgraded by determined actors?

View on HN

If you’re providing a service like Rollbar, Bugsnag, Optimizely, etc which are scripts embedded on customer pages, with XHR api requests, it is sometimes necessary for the client to connect via http if you need to support certain IE versions.

For example; there are certain versions of IE that will throw an insecure content warning if you load https scripts within a http page.

And of course, many older clients don’t (and never will) support newer versions of TLS.

> For example; there are certain versions of IE that will throw an insecure content warning if you load https scripts within a http page.

Does IE support 'schemeless URIs'? like:

    //example.com/resource.js

>warning if you load https scripts within a http page

Why? I get https->http, but why would an upgrade cause a warning?

I can think about one use case, while developing a website right before buying a certificate for your website, you may want to see how your website will behave at a production environment.

Reply on news.ycombinator.com