Why use protocol-relative URLs at all?
Solution 1:
As of December 2014, Paul Irish's blog on protocol-relative URLs says:
2014.12.17: Now that SSL is encouraged for everyone and doesn’t have performance concerns, this technique is now an anti-pattern. If the asset you need is available on SSL, then always use the
https://
asset.
Unless you have specific performance concerns (such as the slow mobile network mentioned in Zakjan's answer) you should use https://
to protect your users.
Solution 2:
Because of performance. Establishing of HTTPS connection takes much longer time than HTTP, TLS handshake adds latency delay up to 2 RTTs. You can notice it on mobile networks. So it is better not to use HTTPS asset URLs, if you don't need it.
Solution 3:
There are a number of potential reasons, though they're all not particularly crucial:
- How about the next time every business with an agenda pushes a new protocol? Are we going to have to swap out thousands of strings again then? No thanks.
- HTTPS is slower than HTTP of same version
- If any of the notes listed at caniuse.com for HTTP/2 are a problem
- Conceptually, if the server enforces the protocol, there is no reason to be specific about it in the first place. Agnosticism is what it is. It's covering all your bases.
Solution 4:
One thing to note, if you are using CSP's upgrade-insecure-requests
, you can safely use protocol-agnostic URLs (//example.com
).