Point rel=canonical to HTTPS on every page
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• tstarling
	Jul 9 2013, 3:09 AM

Description

I propose setting $wgEnableCanonicalServerLink = true everywhere, and setting $wgCanonicalServer to HTTPS on all servers except Chinese language wikis.

We did this with uz.wikipedia.org, and so we know with some confidence that it will cause Google to provide links directly to the https website. This will cause most of our traffic to go to HTTPS.

I'm filing this to create a place for discussion, rather than as an immediate action item. Before this can be done, the SSL cluster would have to be expanded significantly, assuming Ganglia capacity data is correct -- maybe by a factor of 10. It may be simplest to wait until HTTPS is sent directly to Varnish, but even then, some proper capacity calculations would be in order.

This would be an alternative to T50402: rel=canonical of https pages should point to http and a significant step towards T49832: Force all Wikimedia cluster traffic to be over SSL for all users (logged-in and anon).

Update:

In T49832#1240813, @BBlack wrote:

As I've stated before, personally I'd prefer to do the hard redirects before the rel=canonical during the initial rollout process, simply because it's easier to take back in realtime if anything doesn't work out as planned in terms of load and capacity. We already have a process down for this stuff. It's not my place to speak to the rest, but I assure you people are aware and working on it.

See Also:

Details

Reference: bz51002

Related Objects
Search...

Status	Assigned	Task
Resolved	BBlack	T53002 Point rel=canonical to HTTPS on every page
Resolved	Chmarkine	T90527 Enable HSTS and point rel=canonical to HTTPS for all Russian Wikimedia projects
Resolved	BBlack	T49832 Force all Wikimedia cluster traffic to be over SSL for all users (logged-in and anon)
Resolved	BBlack	T86664 HTTPS performance & UA adoption metrics

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 22 2014, 2:01 AM

• bzimport added a project: HTTPS.

• bzimport set Reference to bz51002.

• bzimport added a subscriber: Unknown Object (MLST).

• tstarling created this task.Jul 9 2013, 3:09 AM

I endorse this message.

Chmarkine added a subtask: T90527: Enable HSTS and point rel=canonical to HTTPS for all Russian Wikimedia projects.Feb 24 2015, 5:08 AM

Chmarkine subscribed.

Glaisher subscribed.Feb 24 2015, 5:15 AM

How about first setting canonical to HTTPS for all projects that have signed up for the HTTPS Beta program?
https://meta.wikimedia.org/wiki/HTTPS/Beta_program

JanZerebecki subscribed.Feb 24 2015, 4:55 PM

Chmarkine closed subtask T90527: Enable HSTS and point rel=canonical to HTTPS for all Russian Wikimedia projects as Resolved.Feb 25 2015, 4:37 PM

BBlack added a project: HTTPS-by-default.Feb 25 2015, 6:18 PM

BBlack set Security to None.

Generally rel=canonical will be the final step for a given site, after redirects and such are in place. In the general case, all of that is still pending on the rest of the work in the HTTPS-by-default project, scheduled for circa end-of-March, at which point we can start deciding when and in what order various sites are enabled as part of an operational rollout plan.

Tony_Tan_98 subscribed.Feb 25 2015, 7:35 PM

If we switched over rel=canonical first, we wouldn't have to redirect so many users. So the site would seem faster.

• Mattflaschen-WMF unsubscribed.Feb 26 2015, 11:45 PM

Either way, we'll need a deployment plan that gradually increases load going by wiki domainnames (or sets of them), rather than turning them all on at once. I'm inclined to redirect first because we have more-immediate control there in terms of seeing and reacting to load changes.

Either way please first change the sites URL in Wikidata by contacting either @hoo or @aude. Because of an implementation detail otherwise editing language links breaks. As a side effect of such a change the language links would change to HTTPS.

Bawolff subscribed.Mar 13 2015, 2:53 PM

Sj subscribed.Mar 25 2015, 5:01 AM

Nemo_bis updated the task description. (Show Details)Apr 28 2015, 5:55 AM

Nemo_bis added a subtask: T49832: Force all Wikimedia cluster traffic to be over SSL for all users (logged-in and anon).

He7d3r updated the task description. (Show Details)Apr 28 2015, 11:18 AM

Volker_E subscribed.Jun 12 2015, 6:10 PM

Note, that this has happened for 7 languages (See 8f99d5f4)

Based on https://lists.wikimedia.org/pipermail/wikimedia-l/2015-June/078214.html I imagine the other languages are not far behind.

• dpatrick subscribed.Jun 15 2015, 5:26 PM