HTTPS

[jvanulde]

Does there need to be any discussion around secure channel (e.g. HTTPS) vs HTTP? How about protocol-relative URI's? I understand that it's an anti-pattern. A best practice might be warranted.

[jvanulde]

Sorry, just saw the reference in section 5.4. Again, though a best practice statement at minimum might be warranted.

[cportele]

What kind of best practice statement do you have in mind? Could you make a proposal that we can discuss?

[jvanulde]

@cportele Was thinking of something along the lines of https://https.cio.gov/

[cportele]

Discussed during the meeting on 2017-11-28: The current text seems sufficient for now. If we identify in the period where we will work on implementations of the specification that more guidance is needed (e.g., on redirects from http to https), we will add it.