community.nodebb.org uses http:// resources on secure page

[rfc2822]

Hello,

Currently, community.nodebb.org uses http:// resources on some https:// pages, for instance https://community.nodebb.org/category/2/general-discussion (at the moment). According to Firefox, the resources are

• http://community.nodebb.org/uploads/512-profileimg.png and
• http://i.imgur.com/VreaosQ.png

This causes a security warning in Firefox (HTTPS "lock" sign has a yellow exclamation mark). Maybe external user profile/upload URLs which are embedded should be checked for their URI scheme, and if they're only available as http://, they could be either proxied over https:// or not be shown by default (only if you click on them or something like that). Or maybe just an "insecure" icon that links to the http:// resource…

[julian]

Thanks @rfc2822 -- the first asset was resolved long ago, when we added an SSL certificate to the site. The old link just set in @Chris' profile before we had SSL, so it still says http.

Re: the second link -- we cannot control whether users link images with http or https, as not all sites support transparent http to https routing. I believe the imgur plugin returns https links now.

[Kowlin]

@julian Imgur can return HTTPS links but doesn't force them by default.

[Chris]

@julian sure blame me the second I log back in after a year.

[julian]

@Chris that's for the downvote

@Kowlin Yeah, I believe @baris updated the imgur plugin so any uploaded images will save the https url in the post.