Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Autolink improvements #98

Open
lol768 opened this issue Jun 23, 2018 · 0 comments
Open

Autolink improvements #98

lol768 opened this issue Jun 23, 2018 · 0 comments

Comments

@lol768
Copy link

lol768 commented Jun 23, 2018

From what I understand,

  • Autolink assumes only domains with a leading www. should be linked. Many domains are configured to redirect to the "bare" variant without the www since it is technically unnecessary, so this assumption does not hold.
  • Autolink assumes the insecure http:// protocol. This opens the visitor up to a MitM if they've not visited the site before (for no HSTS preload) or the site doesn't use HSTS and no redirect is cached.

It is proposed:

  • This feature use the Public Suffix List to detect references to domains.
  • The default protocol be changed to https:// since the vast majority of browser page loads are performed using HTTPS nowadays (https://letsencrypt.org/stats/#percent-pageloads). If the user needs to refer to a legacy site, they can specify the link explicitly.
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant