# Protocol agnostic CDN URLs are problematic
**URL:** https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301
**Category:** Feature
**Created:** [February 19, 2019, 1:51pm UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301 "2019-02-19T13:51:23Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [February 19, 2019, 1:51pm UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/1 "2019-02-19T13:51:23Z")
So one potential issue I’ve found was that I was using
`//cdn-url.example.com`
in my `app.yml` – changing it to
`https://cdn-url.example.com`
made things better, there are no errors now.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 30, 2019, 6:41am UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/2 "2019-03-30T06:41:41Z")
Yes, I had the same problem @itsbhanusharma. It’s too bad our default CSP policy doesn’t allow CDN URLs of the protocol agnostic form
`//discourse.cdn.example.com`
Is there some reason why we hard-coded this to https instead of being protocol agnostic @sam? Does CSP require https?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 30, 2019, 6:47am UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/3 "2019-03-30T06:47:35Z")
Protocol agnostic CDN is a bad practice, we should not be using that anywhere really.
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [April 2, 2019, 1:58pm UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/4 "2019-04-02T13:58:36Z")
Besides, CSP specification mandates the protocol [scheme](https://tools.ietf.org/html/rfc3986#section-3.1) to start with a letter, which rules out the `//`; or to use no protocol at all (just the hostname, or [`none`, or `self`, etc.](https://www.w3.org/TR/CSP3/#framework-directive-source-list)) – which also works, but indeed the mix of HTTPS and HTTP already causes browsers (at least Firefox) to turn the green lock into a grey lock with an orange warning sign. No very user friendly.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [April 3, 2019, 5:29am UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/5 "2019-04-03T05:29:31Z")
Should we just silently convert a schemeless CDN to https on config file load?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 3, 2019, 5:51am UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/6 "2019-04-03T05:51:44Z")
mayyyyybe… I kind of prefer not to cause we will still be lumped with fixing all history with a remap anyway.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [April 3, 2019, 5:53am UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/7 "2019-04-03T05:53:44Z")
I think a rebuild should freak out if it sees a CDN beginning with `//` and return a console error advising the user that this is a bad practice, and refuse to progress.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 3, 2019, 6:02am UTC](https://meta.discourse.org/t/protocol-agnostic-cdn-urls-are-problematic/113301/8 "2019-04-03T06:02:33Z")
Sure… why not
[https://github.com/discourse/discourse\_docker/commit/49bc616a963994715b02f792776acf1388314086](https://github.com/discourse/discourse_docker/commit/49bc616a963994715b02f792776acf1388314086)