Use https://<cdn>/ rather than //<cdn>/ for security?

[hartwork]

Hi!

I noticed that there are a few places in here where CDNs are referecing using //<cdn>/ rather than https://<cdn>/. To my understanding that makes requests go through HTTP rather than HTTPS without any gains. Am I missing something? Would you welcome a patch?

# git grep -h "['\"]//" | sort -u
        assert f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/css/select2.min.css' in result
        assert f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/select2.min.js' in result
    CSS = '//cdnjs.cloudflare.com/ajax/libs/select2/{version}/css/select2.min.css'.format(version=LIB_VERSION)
            error = driver.find_element_by_xpath('//body[@JSError]')
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/de.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/en.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/sr-Cyrl.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/zh-CN.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/i18n/zh-TW.js',
            f'//cdnjs.cloudflare.com/ajax/libs/select2/{settings.SELECT2_LIB_VERSION}/js/select2.min.js',
    I18N_PATH = '//cdnjs.cloudflare.com/ajax/libs/select2/{version}/js/i18n'.format(version=LIB_VERSION)
    JS = '//cdnjs.cloudflare.com/ajax/libs/select2/{version}/js/select2.min.js'.format(version=LIB_VERSION)
<script src="//code.jquery.com/jquery-2.1.4.min.js"></script>

[codingjoe]

Hi @hartwork,

// will cause the browser to use the same scheme used by the parent page. If that is served via HTTPS, so will the asset. You can alter that behavior if you override base in your HTML head.

Anyhow, I don't see a big problem since one should server their Django site only via HTTPS and in development you always service over HTTP never file:// with runserver.

With all that being said, I will not reject a patch adding an explicit protocol. I'd welcome it :)

Best,
Joe

[hartwork]

I'm happy to create a pull request once my other pull requests #607 #608 #610 have been reviewed 🍻

[codingjoe]

I'm happy to create a pull request once my other pull requests #607 #608 #610 have been reviewed 🍻

So, no pressure you say? 😉

[hartwork]

Here you go: #611