search

Netflix / netflix.github.com

1.55k stars 446 forks source link

Mixed Content - favicon is server in http #99

Closed vitorinoaraujo closed 8 years ago

vitorinoaraujo commented 8 years ago

As reported in #77 , favicon is being served over http.

Link to favicon is now protocol relative as described in best practices (see http://www.paulirish.com/2010/the-protocol-relative-url/)

kunalkundaje commented 8 years ago

Thanks for submitting this, @vitorinoaraujo

It looks like https://cdn-0.nflximg.com/en_US/icons/nficon2014.4.ico throws an SSL error because the cert is issued for the akamai.net domain rather than nflximg.com

We have an updated favicon asset at https://assets.nflxext.com/us/ffe/siteui/common/icons/nficon2015.ico

Can you update this PR to point to that instead?

Also, you can use the https:// version directly, rather than the protocol-relative one.

Now that SSL is encouraged for everyone and doesn’t have performance concerns, this technique is now an anti-pattern. If the asset you need is available on SSL, then always use the https:// asset. http://www.paulirish.com/2010/the-protocol-relative-url/

vitorinoaraujo commented 8 years ago

Hi @kunalkundaje,

Thank you for pointing out the use of https:// rather than the protocol-relative approach.

I changed the file according your suggestions.

kunalkundaje commented 8 years ago

Thanks! Looks good to me. :+1: Merged via CLI.