Idea: better support for delivering update packages via https AND fallback for http about wp-update-server HOT 3 CLOSED

Some thoughts:

• There's no need for an explicit "pre-check". You already have a perfectly valid "test file" - the metadata URL. Let the plugin optimistically use HTTPS the first time it checks for updates. If the request fails, the update checker can set an "SSL doesn't work" flag in the database and use HTTP for future checks.

  The only drawback is that users whose server doesn't support SSL won't see any updates for the first $checkPeriod hours. I think that's acceptable.

• Automatically downgrading from HTTPS to HTTP is too dangerous to make it the default behaviour. This feature must be opt-in only. I'm thinking something like this:

  $updateChecker->enableHttpFallback($enabled, $retryHttpsAfter = 30 * 24 * 3600);

• The update server already dynamically changes the package URL based on the current protocol (clients using HTTPS get https://... URLs). Unless you pass your own URL to the Wpup_UpdateServer constructor, that is.

from wp-update-server.

Hi Yahnis,
thanks a lot for your feedback - havent thought about using the metadata URL as "pre-check" if https is supported. Will give it a try and let you know the results!
best,
Robert

from wp-update-server.

Not an issue anymore, can be closed.

from wp-update-server.