Move insecure links from "valid" to "invalid"

[sascha11110]

Updated with all comments from below on March 14th 2025

Motivation

Currently we label some links as insecure, for example if they use http instead of https. You can identify insecure links by the "locked" icon which means that the SSL certificate could not be validated.

Proposed Solution

To be in line with the best practices in web, it would be best to move these insecure links from the "valid" section in our link checker to "invalid".

Alternatives

None

User Story

As a user of the CMS I want to see insecure links in the category of "invalid" so that I immediately know which links need some form of work

Additional Context

For documentation the inital report of this issue

Details

Many users include images or other media from sites that do not use https. As a result, our website is marked as "non-secure" in the browser and in addition, this is a fairly high security risk.

Since, from a practical point of view, we cannot completely prohibit users from embedding such content, we should take various soft measures that force users to https.

Update 2021: Since meanwhile https is a very popular standard, it should be safe to completely forbid http content and use a hard enforcement here.

On the one hand, new content is problematic, but so is existing content. Therefore I suggest the following measures:

• The editor points out that the placement of such new content is very critical
• According to API: package site/page resources #46, such contents should not be packaged
• Pages, events, etc. with such content are marked in the corresponding list view
• There should be an additional list of all pages, events, etc. that have such content

Design Requirements

None

Related Issues

Unsure

[svenseeberg]

I guess we can this in the nginx configuration by redirecting everything from HTTP to HTTPS? I don't see any need to implement this in Django.

[sascha11110]

Some users also include content from external sites that do not offer https. In this case the nginx configuration does not help us.

[svenseeberg]

Oh sorry, I did not read carefully enough. Yes, this is a totally valid ticket.

[ulliholtgrave]

We can use the broken link checker to evaluate whether a link can be accessed via HTTPS. This should probably also extended to foreign media sources (e.g. images).