# Sandbox ad on right side of screen doesn't use HTTPS

I recently saw this ad on Worldbuilding:

I hovered over it and saw that this is the link it goes to:

http://worldbuilding.meta.stackexchange.com/ads/ct/7073?url=https%3a%2f%2fworldbuilding.meta.stackexchange.com%2fquestions%2f7183%2fsandbox-for-proposed-questions&s=180e2f25810f79c41228e12f54de8770e28ab11c91cc704f647090556be8183e

This is a non-HTTPS link, and thus insecure. Stack Exchange moved to secure HTTPS a few years ago, and this should be fixed some time to make the network more secure.

This is a non-issue with modern, standards-compliant browsers.

Along with a bunch of other headers, every response to a request to worldbuilding.meta.stackexchange.com comes with these headers:

content-security-policy: upgrade-insecure-requests
strict-transport-security: max-age=15552000


(You can see these yourself in the network console of your browser, or equivalent.)

The effect of these is to (CSP) tell the web browser to use HTTPS for everything referenced from the page (MDN says "non-navigational insecure resource requests are automatically upgraded (first-party as well as third-party requests)" and specifically illustrates with <img>, but not off-host <a href> links), and (HSTS) to record the fact that plain-text HTTP requests to this host are prohibited for a duration of 15,520,000 seconds (180 days).

The CSP thus doesn't necessarily affect the target of the link (MDN seems a little unclear if navigational links to the same host are upgraded). However, the HSTS header does have an effect (MDN), in forcing the browser to only allow HTTPS (technically, "secure") transport to the host that the HSTS header was received from.

Therefore, in practice, as soon as a request is made to the host, it will be force-upgraded to HTTPS before hitting the network. So no plain-text HTTP is involved when clicking on the ad, even though the link says plaintext HTTP.

The link is not wrong. If you visit the source ad, you'll discover the HTTPS link to our Meta page is correct.

I believe you've misunderstood the URL. It's in two parts:

http://worldbuilding.meta.stackexchange.com/ads/ct/7073

This is the first part. It's automatically created by Stack Exchange. We have no control over it. It's only purpose is to invoke the Community Ad server. This is required, at least, to ensure that community ad links are being properly used (without 6 votes, they're not supposed to show up or be usable). I do not know why Stack Exchange does not use the HTTPS protocol for this.

The second part is this:

https%3a%2f%2fworldbuilding.meta.stackexchange.com%2fquestions%2f7183%2fsandbox-for-proposed-questions&s=180e2f25810f79c41228e12f54de8770e28ab11c91cc704f647090556be8183e

As you can see, it uses the HTTPS protocol as assigned in the source community ad. This is the query that's being sent to the Community Ads server. I don't know what the second parameter (s) refers to, but it's likely some form of session ID.

The issue doesn't involve just this one ad. If you hover over any community ad, you'll find the first part of the URL to be the same (other than the numbers, which point to the unique community advertisement).

Insofar as I know, since Stack Exchange is automatically producing the URL you're indicating, it's normal. If you have a concern, you'll need to post it at Meta.StackExchange.com where the developers will see it.