Is basically broken. Specifically it tries too hard to generate absolute URLs all the time and more often than not, it gets them wrong.
I have a site which is hidden behind a proxy server. The WP machine is running a vanilla PHP install on Apache with no SSL cert. The reason being that the blog is but one server in a cluster of many different machines with different jobs all living under a common domain (call it http://www.example.com). There is a NGINX server in front of everything handling routing based on url paths. The NGINX handles the SSL encryption and then communicates with backend servers using http. Works fine.
However – this means that the WP installation thinks it is operating under http rather than https. Any test of headers in any code comes up with protocol http and not https. So any absolute URLs generated such as for style sheets and JS files are being generated with a big fat http: in front and conservative browsers like Chrome are declining to load them as they are viewed as potential security threats. Many themes and plugins are written to only exacerbate the problem but for many it isn’t their fault exactly since they are relying on calls like get_stylesheet_directory_uri() which returns an http: prefixed string on our nifty https: served blog.
In order to fix our site I did the following modifications to various files in wp-includes. I found where the URL was about to be written and I stripped the protocol off of it using something like
$baseurl = ltrim(self::$baseurl,’htpsHTPS:’);
which crudely strips off any leading http/https protocol. The reason this is OK is because RFC 3986 part 4.2 allows for protocol-less or protocol relative URLs. So instead of http://www.example.com it is fine to use //www.example.com and the browser will use whatever protocol was used to fetch the parent page. If WP were to generate these sorts of URLs, wacky plugins like http://wordpress.org/extend/plugins/wordpress-https/ would be totally unnecessary.
Please update WordPress to use protocol-relative URLs. Trying to “guess” the unguessable and getting it wrong is just inviting all sorts of security holes. A developer should feel confident that if he has secured his server, then all his resources will be secured by default.
- The topic ‘WordPress URL generation’ is closed to new replies.