Consider HTTP status code when checking for HTTPS availability

ericlaw1979 / moartls

The moarTLS Analyzer Browser Extension flags non-secure references in web pages.

MIT License

23 stars 5 forks source link

Open vcsjones opened 7 years ago

vcsjones commented 7 years ago

When Alt+Clicking a link in MoarTLS, it will show a "green" arrow for upgradability for any status code. This is a broader request to #13.

I would propose the following rules.

>= 400 means it is not upgradable.
301, 302, 307, and 308 are not upgradable if the Location is for the same URL with an HTTP scheme. Many sites don't "officially" support HTTPS, but have HTTPS -> HTTP redirects anyway to "fix" those links, anyway. Otherwise, if the Location is HTTPS, then mark as upgradable.