查看“HTTPS/zh”的源代码

{{Other languages/HTTPS}}
{{Notice|This page is about the 2013 and 2015 changes to Wikimedia servers to require HTTPS. Unencrypted access with HTTP is no longer possible.}}
'''[[:en:HTTPS|HTTPS]] (Hypertext Transfer Protocol Secure)''' is a web protocol that improves the security of communication between the user and the server. With it enabled:
* you can be sure the content you are viewing has not been modified by any intermediary such as an ISP or government system;
* it makes it much more difficult (but not impossible) for a third party to determine what article you are viewing,
* you can be sure nobody can change the content of your edits during their transport to the Wikimedia servers, and
* you can be sure that nobody can take over your account by stealing your password or session cookie.

The continued work to improve the security and privacy of Wikimedia project users is a stated goal of the Wikimedia Foundation. This work has been escalated in prominence by the United States [[:en:National Security Agency|National Security Agency (NSA)]] domestic spying scandal revealed by [[:en:Edward Snowden|Edward Snowden]] in the summer of 2013. The Wikipedia project was referenced in several documents as a specific source for tracking users’ behavior online.<ref>[https://twitter.com/jimmy_wales/status/362626509648834560 Jimmy Wales’ tweet], see the linked image leaked from a "top secret" document.</ref> Browsing the web via the insecure HTTP protocol allows third-parties to track what pages you view and information you send online.

Wikimedia used to have a dedicated secure server (secure.wikimedia.org) for HTTPS connections.  '''Now, all connections to Wikimedia projects are encrypted, and unencrypted access is no longer possible''', and the URL above redirects to the appropriate Wikimedia project.

== What this means for you ==
In addition to the previous improvements to privacy and security on Wikimedia sites (see below), on Wednesday, August 28, 2013, at 1 pm PDT, the Wikimedia Foundation defaulted to HTTPS for all logged-in users. How this works is simple: If a user wants to log in, the login will happen over HTTPS (thus keeping their username and password secure), and after they are logged in they stay on the HTTPS version of the Wikimedia site they are using.

== Proxies ==

If you are behind a proxy, for instance, a caching proxy to improve web experience in a place with bad networking, and the proxy prevents you from using Wikimedia sites over HTTPS, please contact the maintainers of the proxy and ask them if they can fix it, and if not why.

In limited, controlled environments like schools and corporations, where the entity also controls the browsers/devices, they can technically proxy cache HTTPS. There are commercial solutions to do so which rely on, basically, installing a fake root certificate into the browsers/OSes, which their proxy cache uses to generate fake SSL certs for the sites being proxied, etc.

== Help! My code is broken! ==
Are you a bot maintainer or Gadget author and you're seeing weird or broken behavior after this switch? Hopefully, you can fix that easily.

For Gadget authors, simply modifying any hardcoded URLs from "<nowiki>http://...</nowiki>" to "//..." should fix the issue (this is called using "protocol relative URLs").

For bot maintainers, you have a couple of choices. Either login as the bot and select the preference to not use HTTPS for that account, or update your code to use SSL instead. If you use Pywikibot, please update to the latest version (More technical details: [https://gerrit.wikimedia.org/r/80003],[https://gerrit.wikimedia.org/r/80006]) and read [[mailarchive:pywikipedia-l/2013-August/008214.html|this]] mailing list post for more information.

== Various problems ==

=== Redirects to sec-warning ===
When Wikimedia is deprecating outdated security protocols, users may be redirected increasingly often to a page titled: [https://en.wikipedia.org/sec-warning Your Browser's Connection Security is Outdated]. This means that you should update your browser [[wikitech:HTTPS/Browser_Recommendations|Browser and/or Operating System]] because otherwise you will soon not be able to connect to Wikimedia websites.

=== Autocomplete no longer working ===
Users of Internet Explorer 8, 9 and 10 report that auto-complete of the edit summary field no longer works under HTTPS. This issue can be fixed by upgrading to Internet Explorer 11.

=== Bots ===
API requests are now being forced redirected to HTTPS on some languages. On most bot frameworks, this should just work, but a few bot maintainers have reported problems. If your bot has problems, make sure that the library you are using supports HTTPS, and has access to appropriate root certificates.

=== Missing images ===
If images are missing, check if you can see for instance [https://upload.wikimedia.org/wikipedia/commons/thumb/7/77/10_sharing_book_cover_background.jpg/120px-10_sharing_book_cover_background.jpg this thumb image from Commons]. If you get a certificate warning please see the [[HTTPS#Certificate error or warning|next section about this]].

=== Missing scripts ===
If you had custom scripts that you retrieved by calling a function <code>loadJS</code> or <code>importScriptUri</code>, you should change the function or the syntax to call scripts with <code>"http'''<u>s</u>'''://..."</code> or better yet, with protocol-relative URL's like this, <code>"//..."</code> without the <code>http:</code> or <code>https:</code>. In any case, there is a generic function in the [[MediaWiki:Common.js]] of your wiki that is preferable to a custom function. 

If you are still using syntax like <syntaxhighlight lang="javascript" inline>document.write('<script src="http://..." />');</syntaxhighlight> replace it immediately with <code>[[mediawikiwiki:ResourceLoader/Default_modules#mw.loader.load|mw.loader.load]]</code>, because the <code>document.write</code> methodology can easily break in certain browsers.

=== Certificate error or warning ===
If your browser silently removes the safe in the address bar (or bottom of your browser) or explicitly issues a warning:
* you can check if your computer clock is up-to-date: since the HTTPS certificate is valid during a specific time range (January 2012-January 2016 for Wikimedia projects), any bad clock will generate a warning;
* you can check whether you have the authority certificate with the following explanations; if you don’t find it, please report in the [[Talk:HTTPS|talk page]]
** Firefox: go to Edit > Preferences > Advanced > Encryption > View Certificates > Authorities and you should find the certificate "Digicert Inc" > "DigiCert High Assurance EV Root CA";
** Opera: go to Tools > Preferences > Advanced > Security > Manage Certificates > Authorities and you should find the certificate "DigiCert High Assurance EV Root CA";
* check the site you are visiting is really Wikipedia or a Wikimedia project: the address bar should be <code><nowiki>https://your-language.wikipedia.org</nowiki></code> or the exact name of your project; if there are strange characters in the address bar (dashes in the project name, unusual slashes, etc.) this is possibly a fake website, please report it in the talk page [[m:Talk:HTTPS|https://meta.wikimedia.org/wiki/Talk:HTTPS]]
* check if you also have a certificate error in the domains [https://upload.wikimedia.org/wikipedia/commons/thumb/7/77/10_sharing_book_cover_background.jpg/120px-10_sharing_book_cover_background.jpg upload.wikimedia.org] and [https://bits.wikimedia.org/geoiplookup bits.wikimedia.org]
* report it in the [[Talk:HTTPS|talk page]] and specify your browser, your browser version (generally in the browser menu Help > About), your operating system and its version.

=== Effect on unregistered contributors ===
Once HTTPS is switched fully on, there will be no option to disable, and all users will have to use it (This is necessary to prevent the SSL-stripping attack)

== History of HTTPS at WMF ==

=== Initial activation in 2005 ===
HTTPS was first activated on the Wikimedia projects [[mailarchive:wikitech-l/2005-December/020946.html|by Brion in December 2005]], although it was on special URLs of the form <code><nowiki>https://secure.wikimedia.org/wikipedia/en/wiki/Main_Page</nowiki></code> and it was quite slow and unscalable (one single server for this task), making it unsuitable for everyone’s use.

=== Large-scale deployment in 2011 ===
HTTPS with canonical URLs <code>http'''s'''<nowiki>://en.wikipedia.org/wiki/Main_Page</nowiki></code> was activated in [[wmfblog:2011/10/03/native-https-support-enabled-for-all-wikimedia-foundation-wikis/|October 2011]], after months of effort to make it work in a cache-friendly manner. This meant that

* [[labsconsole:Https#Protocol-relative URLs|protocol-relative links]] could be used, to avoid caching two versions of the same page;
* correctly setting up servers and caching to handle HTTPS; and
* ensuring that all resources were served using the same protocol, either HTTP or HTTPS, to avoid mixed content on the page (mixed content negates the secure state of the page). 

This deployment of HTTPS was described in [[mediawikiwiki:Category:Wikimedia engineering reports|Wikimedia engineering reports]] from [[mediawikiwiki:Wikimedia engineering report/2011/May|May 2011]] to [[mediawikiwiki:Wikimedia engineering report/2011/December|December 2011]].

=== August 28, 2013 - Secure log-in, with secure browsing and editing for logged in users ===
Per the plan laid out in the blog post titled "[[wmfblog:2013/08/01/future-https-wikimedia-projects/|The future of HTTPS on Wikimedia Projects]]", as of Wednesday, August 28, 2013 at 1pm PDT (that's 20:00 UTC), logging in will be done using HTTPS for the majority of editors and projects. (We originally announced that the change would take place on August 21st; we've pushed that date one week back.<ref>[//lists.wikimedia.org/pipermail/wikitech-l/2013-August/071395.html "Wikitech-l: HTTPS for logged in users delayed. New date: August 28"]</ref>) Logged-in users will browse and edit using HTTPS by default.

=== 2015 ===
In June 2015, the WMF [[wmfblog:2015/06/12/securing-wikimedia-sites-with-https/|announced]] the ongoing transition of all of the Wikimedia wikis to HTTPS, without an ability to opt out.

All wikis are now converted to HTTPS-only. Converting to HTTPS-only entails the following:
*The HTML [[w:Canonical_link_element|&lt;link rel="canonical" ..&gt;]] tag is set to HTTPS. This tells search engines to return the HTTPS version in search results.<sup>{{gerrit|8f99d5f4a5009b4a}}</sup>
*When visiting the http project in question, the web browser receives a redirect ([[w:HTTP_301|HTTP 301]]). This tells the web browser that the website has permanently moved to the HTTPS version.<sup>{{gerrit|cfc9dbe40323b3157}}</sup>
*[[w:HTTP Strict Transport Security|HSTS]] headers are enabled. This tells the web browser that once it has visited the website over HTTPS once, it must always use HTTPS in the future. This prevents people from "opting-out" of HTTPS, but is required to prevent certain attacks on HTTPS where a malicious person could trick the browser into loading the unsecured HTTP version (and then hijack the page) even if the user would normally use HTTPS. <sup>{{gerrit|c8d38e4aabb327273de}}</sup>

Later on, long-term (1 year) HSTS was enabled, and Wikimedia projects were added to browser HSTS pre-load lists.

=== Rolling improvements ===
Wikimedia routinely increases security by removing support for older security algorithms and protocols, following the advice and progress of the major browser vendors and the global security community. Users affected by such removals will gradually see increasing occurrences of being redirected to the [https://en.wikipedia.org/sec-warning sec-warning page], until they will no longer be able to reach Wikimedia websites altogether. The policy for this is documented on [[wikitech:HTTPS]].

=== 2021 ===
* [[HTTPS/2021 Let's Encrypt root expiry]]

== Links ==

* General links:
** [[:en:Wikipedia:Secure server|Wikipedia:Secure server]] on the English Wikipedia
** [[:en:HTTP Secure|HTTP Secure (HTTPS)]] article on the English Wikipedia
** [[HTTPS/Discussions]]: subpage with topics around HTTPS and past discussions
** [[HTTPS/Beta program]]: A signup page for projects wishing to join the HTTPS beta program
* History:
** [[mailarchive:wikitech-l/2005-December/020946.html|Activation of the experimental HTTPS server in 2005]]
** [[wmfblog:2011/10/03/native-https-support-enabled-for-all-wikimedia-foundation-wikis/|Activation of the canonical HTTPS in October 2011]]
** [[wmfblog:2013/08/01/future-https-wikimedia-projects/|The future of HTTPS on Wikimedia projects]] (English, 中文) ([http://blog-fr.seb35.lautre.net/?p=230 français])
* Operations:
** [[phab:tag/https-by-default/|phabricator:tag/https-by-default/]]
** [[bugzilla:27946|Tracking bug about HTTPS]]
** [[labsconsole:Https|Https on wikitech wiki]]
** [[labsconsole:HTTPS/Future_work|Initial wikitech discussion on implementation next steps]]

=== References ===
<references />

=== See also ===
* [[HTTPS/Persian Wikipedia stance|Persian Wikipedia stance]] 

[[Category:Wikimedia Foundation technical notices{{#translation:}}]]