Question

I want to construct URLs with the same scheme (presumably, “http:” or “https:”) as the page that loaded the currently-running JavaScript. Modern browsers support simply omitting the scheme (for example, src="//example.com/test.js"), but this isn’t fully cross-browser compatible. (I’ve read that IE 6 is the only browser that doesn’t support it, but I still need compatibility with that version.)

The cross-browser way to do this seems to be to check location.protocol. For example, Google Analytics uses:

('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + ...

In Google’s case, they wanted to use different domains depending on whether the request uses SSL, so that pattern makes sense. But I’ve seen others use the same pattern even when only the protocol is different:

('https:' == location.protocol ? 'https:' : 'http:') + "//example.com"

(One example is in the “Final Wufoo Snippet” at http://css-tricks.com/thinking-async/.)

I’d prefer to use this simpler expression instead:

location.protocol + "//example.com"

Should I really be concerned about the possibility of location.protocol taking on some value other than “https:” or “http:” when my code is used on sites I don’t control?

Answer 1

It will always be set to something, but it may sometimes be set to a value that is neither “http” or “https”. The three other values you’re most likely to see are file: (for HTML files), about: (for iframe magic involving about:blank), and perhaps ftp:.