# Duplicate http/https topics are randomly created

**URL:** https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190
**Category:** Support
**Created:** [January 3, 2018, 8:05pm UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190 "2018-01-03T20:05:29Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![spectrum](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/spectrum/32/142226_2.png) [@spectrum](https://meta.discourse.org/u/spectrum)
#### Post date: [January 3, 2018, 8:05pm UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190/1 "2018-01-03T20:05:30Z")

</div>

Hi there,  
I recently transitioned my site from HTTP to HTTPS; all Discourse threads link to their original posts at [http://sitename.com/posts/](http://sitename.com/posts/)[post number], and with redirects in place it still works great for browsers.

However, we’re seeing some duplicate threads show up somewhat randomly, with original posts linking back to HTTPS links for posts on the homepage. As an example, for a thread created in ~2014 originating from [http://sitename.com/posts/243](http://sitename.com/posts/243), there’s now a new thread with no replies created, linking back to [https://sitename.com/posts/243](https://sitename.com/posts/243). I had written the discourseEmbedUrl as [http://sitename.com](http://sitename.com) to avoid the system mistakenly creating duplicate threads, but it still seems to do it randomly.

The code I’m using on the template page is here (with substitutions made):

```
      <script type="text/javascript">
        var discourseUrl = "https://discussion.sitename.com/",
            discourseEmbedUrl = "<?php print 'http://sitename.com/posts/'.$post->postId; ?>";

        (function() {
          var d = document.createElement('script'); d.type = 'text/javascript'; d.async = true;
            d.src = discourseUrl + 'javascripts/embed.js';
          (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(d);
        })();
      </script>

```

The variables discourseUrl and discourseEmbedUrl differ in HTTP/HTTPS approach because I did not want Discourse to view a post as “new” and re-create it, because of simply being accessed over HTTPS instead of over HTTP. Since browsers get redirected from HTTP to HTTPS, it’s worked thus far except for having random duplicates.

Has anyone else had this issue before? I had thought specifying [http://sitename.com](http://sitename.com) instead of [https://sitename.com](https://sitename.com) would be clear enough to avoid this issue so Discourse would see there is already a thread created for the post in question, but something seems to be going wrong still.

Is there a different approach I should take so that there aren’t random duplicate threads created?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 3, 2018, 10:57pm UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190/2 "2018-01-03T22:57:47Z")

</div>

Are you sure you have force HTTPS set in your site settings on the target Discourse? That is absolutely required.

---

<div class="post-metadata">

### Author: ![spectrum](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/spectrum/32/142226_2.png) [@spectrum](https://meta.discourse.org/u/spectrum)
#### Post date: [January 3, 2018, 11:22pm UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190/3 "2018-01-03T23:22:49Z")

</div>

Hi Jeff,  
I just double-checked, and verified we do have force HTTPS enabled in the site settings of Discourse. The only portion to my knowledge that we’ve specified HTTP only and not HTTPS is in discourseEmbedUrl, so we wouldn’t have every post re-created as HTTPS after the transition…

Do you know if it would have anything to do with CORS origins? We have those set to [https://sitename.com](https://sitename.com) instead of [http://sitename.com](http://sitename.com), but I didn’t think that would make the random duplicate posts appear…

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 3, 2018, 11:36pm UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190/4 "2018-01-03T23:36:40Z")

</div>

@techapj can you take a look here? From the purposes of the embedder, be sure that we consider http and https versions of the same link as identical, and prefer https – particularly if force https is on.

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [January 4, 2018, 8:08pm UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190/5 "2018-01-04T20:08:46Z")

</div>

Fixed via:

> <https://github.com/discourse/discourse/commit/9030d3ef6316431da2e070d1449acb90da57c4b8>
>
> https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77…190

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [January 4, 2018, 8:11pm UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190/6 "2018-01-04T20:11:43Z")

</div>

Make sure that the canonical URL you’re providing to the embed script always uses HTTPS, and doesn’t vary by e.g. query string parameters, port number, aliased domain names, etc.

If some of your embeds are HTTP and some are HTTPS, it’ll be a crapshoot which one gets linked to from Discourse.

If you wanted, you could even add `?utm_medium=discourse` after removing existing source tracking 🙂

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [September 27, 2018, 2:57am UTC](https://meta.discourse.org/t/duplicate-http-https-topics-are-randomly-created/77190/7 "2018-09-27T02:57:01Z")

</div>