43

It's been an oft-discussed question on StackOverflow what this means:

 <script src="//cdn.example.com/somewhere/something.js"></script>

This gives the advantage that if you're accessing it over HTTPS, you get HTTPS automatically, instead of that scary "Insecure elements on this page" warning.

But why use protocol-relative URLs at all? Why not simply use HTTPS always in CDN URLs? After all, an HTTP page has no reason to complain if you decide to load some parts of it over HTTPS.

(This is more specifically for CDNs; almost all CDNs have HTTPS capability. Whereas, your own server may not necessarily have HTTPS.)

5 Answers 5

53

As of December 2014, Paul Irish's blog on protocol-relative URLs says:

2014.12.17: Now that SSL is encouraged for everyone and doesn’t have performance concerns, this technique is now an anti-pattern. If the asset you need is available on SSL, then always use the https:// asset.

Unless you have specific performance concerns (such as the slow mobile network mentioned in Zakjan's answer) you should use https:// to protect your users.

3
7

Because of performance. Establishing of HTTPS connection takes much longer time than HTTP, TLS handshake adds latency delay up to 2 RTTs. You can notice it on mobile networks. So it is better not to use HTTPS asset URLs, if you don't need it.

6
  • I say it's better to use https cuz of http2 performance and it's more secure!
    – Endless
    May 14, 2017 at 16:47
  • 9
    This is 2 years old answer, when HTTP2 was not available yet.
    – zakjan
    May 23, 2017 at 12:42
  • 7
    This answer is no longer true. Enable HTTP2 on your websites and HTTPS is faster than HTTP.
    – Qwertie
    Jan 16, 2018 at 4:31
  • 3
    As you should definitely know by now, it is not that HTTPS is now faster than HTTP, it's that HTTP is now faster than older HTTP, and only the HTTPS version of it has been implemented at all. HTTPS is still and always will be necessarily slower than HTTP. Nov 15, 2018 at 17:12
  • Note that //: links are ruined when the page is saved offline. joonas.fi/2016/12/27/stop-using-protocol-relative-urls Nov 23, 2019 at 2:49
4

There are a number of potential reasons, though they're all not particularly crucial:

  • How about the next time every business with an agenda pushes a new protocol? Are we going to have to swap out thousands of strings again then? No thanks.
  • HTTPS is slower than HTTP of same version
  • If any of the notes listed at caniuse.com for HTTP/2 are a problem
  • Conceptually, if the server enforces the protocol, there is no reason to be specific about it in the first place. Agnosticism is what it is. It's covering all your bases.
0
1

One thing to note, if you are using CSP's upgrade-insecure-requests, you can safely use protocol-agnostic URLs (//example.com).

0

Protocol-relative URLs sometimes break JS codes that try to detect location.protocol. They are also not understood by extremely old browsers. If you are developing web services that requires maximum backward-compatibility (i.e. serving crucial emergency information that can be received/sent on slow connections and/or old devices) do not use PRURLs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.