Using https https://example.com/ for Shops gets more important and there are a lot of good reasons to force it for secure URLs in Magento.

But, why use http http://example.com for unsecure URLs as default. Would there be a good reason to not use //example.com/ as unsecure Base URL?


At least you'd need to turn off base URL checking then because Magento would not match "//example.com/" to the requested URL, leading to an infinite redirect loop.

But if you want to use HTTPS everywhere, using https://example.com/ as unsecure base URL will work.

Update: I use protocol relative URLs for "skin" on a EE 1.14.2 project now to always load web fonts from the same protocol (otherwise there are cross origin issues). It works fine, but it was not possible to enter the URL in the Magento backend, so I had to update core_config_data directly in the database. Saving the configuration in the "Web" section results in a validation error because Magento expects any URL to start with http (or with the placeholders for un/secure base url)


I think the why is not just technical, but also historical. Magento launched just around the time that Protocol Relative URLs were invented and support was minimal.

Secondly: email. I would easily use (and have used) protocol relative URLs with the base_link_url and media/js/skin. These have a predicable parent to relate to. But for email it's unclear. The plaintext version of the email also won't link.

I think PRU's will become more important this year. Last week noticed that Chrome now refuses to load external content when the protocol does not match. So an HTTPS iframe winthin an HTTP page. Protocol relative solves this by design.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.