638699 - Links to Facebook and Twitter should be HTTPS

Status: VERIFIED FIXED

(www.mozilla.org :: General, enhancement)

Description

[OsamaKM]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20110103 Fedora/3.6.13-1.fc14 Firefox/3.6.13
Build Identifier: 

Mozilla.com replaces most links from HTTP to HTTPS on HTTPS connections, but Facebook and Twitter are often left unchanged. Here are a few examples I found:

* https://www.mozilla.com/en-US/firefox/beta/
* https://www.mozilla.com/en-US/firefox/beta/feedback/
* https://www.mozilla.com/en-US/press/bios/
* https://www.mozilla.com/en-US/firefox/connect/ (link to YouTube needs to be in HTTPS, too)
* Links in mozilla.com the footer, after "Let's be friends".

Please fix those.

Reproducible: Always

Comment 1

[OsamaKM]

https://www.mozilla.com/en-US/firefox/3.6.14/whatsnew/ (and other 'whatsnew' pages) can be added to the list.

Comment 2

[John Slater]

Thanks - adding to the queue.

Comment 3

[Pascal Chevrel:pascalc]

Is there some plan to switch the site to https? Because in-product pages link to http so the only way for a user to get to a whatsnew page in https would be for him to manually change the url just after he has upgraded.

Comment 4

[OsamaKM]

John, please add links to Creative Commons website to the list. (http://creativecommons.org/licenses/by-sa/3.0/ should be https://creativecommons.org/licenses/by-sa/3.0/ on HTTPS connection).

Comment 5

[Steven Garrity [:sgarrity]]

Is this really necessary? We don't have HTTPS on by default, and you're leaving mozilla.com for another website. To be consistent, we'd have to do this for all external links.

HTTPS isn't really a cross-site feature.

Comment 6

[OsamaKM]

It's common to redirect users who are connecting using HTTPS to HTTPS page and that should include other websites that support HTTPS.

Comment 7

[James Long (:jlongster)]

I'm inclined to say leave it as is. Like Steven said, it'll be hard to be consistent across the site, and we don't force https.

If anything, lets wait because the footer is changing. Not sure where the twitter/facebook comes in with the new one:

http://www-trunk.stage.mozilla.com/en-US/firefox/fx/

Comment 8

[Steven Garrity [:sgarrity]]

I appreciate the suggestion, but we'll keep external links HTTP by default. We'd have to check external domains for support before doing any linking.

Comment 9

[Tom Lowenthal]

When we have links in the structure of the site, where we know that they go to https-enabled services, we should use HTTPS links. This would cover things like the Twitter, Facebook, and Creative Commons links in the footer of the page.

In addition, it would be good practice to have HTTPS links throughout the HTTPS version. If the barrier to this is the manual work of deciding and checking which links to change, then we should us something the rewrite rules from the EFF's HTTPS-everywhere to automate switching as many links as possible.

Comment 10

[Kohei Yoshino]

Solution: Replace 

<a href="http://twitter.com/firefox">
<a href="http://facebook.com/Firefox">

with

<a href="//twitter.com/firefox">
<a href="//facebook.com/Firefox">

:)

Comment 11

[Kohei Yoshino]

Now Twitter uses HTTPS by default.
http://blog.twitter.com/2012/02/securing-your-twitter-experience-with.html

I think those links should be HTTPS anyway.

Comment 12

[Mike Alexis [:malexis]]

Are we still moving forward with this?

Comment 13

[Jesse Ruderman]

Twitter and Facebook both redirect all http connections to https.  So we should just link to https.

Comment 14

[Kohei Yoshino]

Pull request: https://github.com/mozilla/bedrock/pull/884

Comment 15

[Kohei Yoshino]

Updated the summary per comment 13.

Comment 16

[Kohei Yoshino]

Commit pushed to master at https://github.com/mozilla/bedrock

https://github.com/mozilla/bedrock/commit/c16d29e95fc4be34b1c0e8495058dd49e8997bf5
Bug 837763 - Add Firefox's Google+ and YouTube links to universal footer

Also fixes Bug 638699 - On HTTPS connection, links to Facebook and
Twitter should be HTTPS

Comment 17

[Kohei Yoshino]

https://www-dev.allizom.org/en-US/#colophon