Outdated GRDDL profile URL

Not sure if this is the right way to bring this up but...

The link referenced above (http://www.w3.org/1999/xhtml/vocab) now redirects to a secure HTTP (HTTPS) version: https://www.w3.org/1999/xhtml/vocab

I found that this URL is defined in /includes/theme.inc on line 2627 (Drupal 7.96). Could the URL be updated to use the HTTPS link?

hey @rbruch, in regards to

Could the URL be updated to use the HTTPS link?

basically HTTPS is HTTP with encryption and verification, I think url with HTTP will be sufficient in this scenario. Let me know your thoughts?

Hi @heykarthikwithu, thanks for responding.

I acknowledge up front that this is a minor issue, and it would likely not cause any problems to leave as is. But it seems like a minor change, with no unwanted side effects that I can think of.

Some background... This came to my attention when I used an automated link scanner/checker (Xenu) on one of my Drupal 7 sites. It checks "visible" links that show in the page content as well as "not-visible" links like this one. The tool gives a report about redirected links, and that's when I noticed this one. I can add an exception for this link and the tool will stop notifying about it.

However, I think generally it's better to link directly to a target web page, via HTTPS if applicable, to avoid making the remote server do the redirect/rewrite.

And I believe it may be that allowing the browser to first request HTTP may introduce an opening for security issues, see this page for some background: https://https.cio.gov/hsts/.

What do you think?

I have done a similar scan few years ago and in D7 core there is a big amount of different links pointing to HTTP protocol (some to drupal.org, some to external sites). I am not sure if changing one specific link is worth the effort. But thanks for pointing this out @rbruch. Anyway, if we would like to continue this discussion, please open a new issue (this one is 10 years old, so we do not mix things up). Thanks!