Bezpieczeństwo

`security/https-only`

Every page and every resource it loads use HTTPS; no mixed content and no http:// links to your own site.

poważnaw przeglądarcefe-security

Dlaczego

Without HTTPS anyone on the network can read and change the page, including injecting script. Browsers block or warn about mixed content, so an http:// image or script on an HTTPS page breaks or degrades it, and many APIs (service workers, geolocation, clipboard) need a secure context.

Poprawka

Serve the site only over HTTPS with a redirect from HTTP and an HSTS header, write own-site links as relative or https:// URLs, and load third-party resources over HTTPS. Search the code for http:// in src, href and API base URLs.

Przykłady

<!-- bad -->
<img src="http://example.com/logo.png" alt="Acme">
<!-- good -->
<img src="/logo.png" alt="Acme">

Źródła

Fakty

Identyfikator: security/https-only
Waga: poważna
Sprawdzanie: w przeglądarce wymaga wyrenderowanej strony: audit --url
Dotyczy plików: page
Ten sam problem w: Lighthouse is-on-https
Uczy jej skill: fe-security Front-end security
Od wersji: 0.1.0

Plik reguły na GitHubie

Przeczytaj w terminalu

npx github:dawidolko/frontend-skills explain security/https-only