Use HTTPS for Disqus requests

[adamatan]

The problem

Disqus does not load from https:// sites under the gum theme (and almost any other). This happens because the Disqus URL prefix is http://, and insecure content will not be loaded from a secure site.

The solution

Disqus documentation

According to the official Disqus documentation, the embed code source should use Protocol-relative URL:

s.src = '//XXXXX.disqus.com/embed.js';

While themes use:

s.src = 'http://XXXXX.disqus.com/embed.js';
s.src = 'https://XXXXX.disqus.com/embed.js';

Where XXXXX is the Disqus site name, denoted {{ DISQUS_SITENAME }} in Pelican.

My solution

I've converted both http:// and https:// prefixes to the https, which will only work. Following comments on this thread, I decided to avoid Protocol-Relative URLs and just go secure in every call.

See further discussion here: getpelican/pelican#1911

[justinmayer]

Protocol-relative URLs are an anti-pattern. Do some searching around and you will see links that explain why.

[adamatan]

@justinmayer Thanks for the comment. Will do some reading.

However, that's the official Disqus recommendation, and leaving the current http prefix is clearly wrong.
The only other viable option is forcing https, but I'm not sure it's better than a Protocol-relative URL in this case.

[justinmayer]

As I mentioned before, using https everywhere, regardless of how the site itself is served.

[justinmayer]

I should add that I believe their official recommendation is just plain wrong. Why not call a resource via HTTPS if it's available via HTTPS?

[justinmayer]

See note at top: http://www.paulirish.com/2010/the-protocol-relative-url/

[adamatan]

Sure, I read that one.

So, should I make another PR with https everywhere?

[justinmayer]

I suggest using this existing PR, squashing your commits once you're done.

[adamatan]

Done.

[justinmayer]

Excellent. Many thanks, Adam!

[adamatan]

@justinmayer Sure thing - thanks for accepting.

While on the same page, what's your opinion about #373?

If built correctly, it can ease not only Disqus, but also for other boilerplate code like Google Analytics.