X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/ba17b7b96b72c9e9b42a24e6e58441e0710c433a..04a88fcfdc748a01c27887bf1a6e4433937b7864:/doc/todo/Protocol_relative_urls_for_stylesheet_linking.mdwn

diff --git a/doc/todo/Protocol_relative_urls_for_stylesheet_linking.mdwn b/doc/todo/Protocol_relative_urls_for_stylesheet_linking.mdwn
index ccbaf4e73..307c528ca 100644
--- a/doc/todo/Protocol_relative_urls_for_stylesheet_linking.mdwn
+++ b/doc/todo/Protocol_relative_urls_for_stylesheet_linking.mdwn
@@ -20,12 +20,27 @@ but this breaks all sorts of things, like the 404 plugin and wiki rebuilds will
 > CGI-generated pages should generate those links. This was the implementation of
 > [[todo/want_to_avoid_ikiwiki_using_http_or_https_in_urls_to_allow_serving_both]].
 >
+>> This wasn't actually the case if the schemes are different; but now
+>> IkiWiki will generate protocol-relative URLs if the CGI is https,
+>> the url is http and the hostname is the same (i.e. it assumes that the https
+>> equivalent of the url will also work). This is to prevent mixed-content
+>> issues, and partially addresses this todo item.
+>> --[[smcv]]
+>
 > If your`$config{url}` and `$config{cgiurl}` have different hostnames (e.g.
 > `url => "http://wiki.example.com", cgiurl => "http://cgi.example.com/ikiwiki.cgi"`)
 > then you might still have this problem. In principle, IkiWiki could generate
 > protocol-relative URLs in this situation, but it isn't clear to me how
 > widely-supported those are.
 >
+>> HTML5 says protocol-relative URLs work, and they seem to be widely
+>> supported in practice, so I've changed the rule to: if the url and cgiurl
+>> share a scheme (protocol) but differ only by hostname, use `//foo/bar`
+>> protocol-relative URLs. This partially addresses this todo.
+>> I'm still thinking about what the right thing is for more complicated
+>> situations: see [[todo/design for cross-linking between content and CGI]].
+>> --[[smcv]]
+>
 > If you set both the `$config{url}` and `$config{cgiurl}` to https, but make
 > the resulting HTML available over HTTP as well as HTTPS, that should work
 > fine - accesses will be over http until the user either explicitly