All URLs should be https

jdx / mise

dev tools, env vars, task runner

https://mise.jdx.dev

MIT License

8.03k stars 210 forks source link

All URLs should be https #2311

Closed StingRayZA closed 1 week ago

StingRayZA commented 1 week ago

There's a number of URL calls that aren't https. In some cases the web server will redirect that call to an https version, but in some cases a 'pure' http response will be served.

These calls should all be upgraded to https.

StingRayZA commented 1 week ago

fix incoming (PR TBC)

StingRayZA commented 1 week ago

Hey @jdx

Any reason why this is undesired?

jdx commented 1 week ago

https://github.com/jdx/mise/pull/2266

StingRayZA commented 1 week ago

Gotcha, thanks. FWIW, I've encountered issues in the past:

unsecured http doesn't work from some locations.
MITM attacks are harder when you're enforcing https (I don't know if rust inherently does any level of cert validation)