We’re currently still supporting HTTP environments to some extent, but there are already shortcomings in regards to newer browser features becoming more and more limited. Considering that Let’s Encrypt is widely adopted these days it is finally time to move to HTTPS only, allowing us to take advantage of never features.
HTTPS is a hard requirement of both #5805 and #5905 because (some part of) the underlying API is only available in secure contexts.
[x] Check for HTTPS in the test script.
[x] Validate HTTPS in the setup process.
[x] Add the HTTPS check to the SystemCheckPage.
[x] Add the HTTPS check to the IndexPage / notices box.
[x] Redirect requests for the frontend from insecure contexts to HTTPS.
[x] Add a pre-upgrade check to the upgrade from 6.0 to 6.1.
We’re currently still supporting HTTP environments to some extent, but there are already shortcomings in regards to newer browser features becoming more and more limited. Considering that Let’s Encrypt is widely adopted these days it is finally time to move to HTTPS only, allowing us to take advantage of never features.
HTTPS is a hard requirement of both #5805 and #5905 because (some part of) the underlying API is only available in secure contexts.
SystemCheckPage.IndexPage/ notices box.127.0.0.1localhost*.localhost