|
|
|
|
|
by cryptoplot
2753 days ago
|
|
People have their reasons, we respect that. But a default to https, why not? It seems reasonable to me. I am not sure on how to get https:// by default while still supporting http:// for people who prefer it. It may take some advanced 302 redirect. We will investigate and see what we can do there. Suggestions are much appreciated. |
|
That said, a couple ideas on how to implement:
* Use an alternate domain, eg `insecure.domain.com`
* Use an alternate path prefix, eg `domain.com/insecure/` -- your app would have to be able to handle this
* Use a parameter that sets a cookie that your load balancer/reverse proxy can understand, eg, `http://domain.com/?https=false`, and will prevent redirect -- definitely the most complex from the proxy point-of-view, but means the URL (other than the scheme) is consistent for both types of user