Dyalog / Dyalog/documentation

Internal links omit trailing slashes, causing a redirect through unencrypted HTTP

Open
#1,116 1 comment 0 reactions 1 assignee Claimed by @xpqz View on GitHub
tooling
Dominant language
Python
Stars
9
Forks
7
Avg merge
1d 9h
Merged PRs (30d)
56

Description

Many internal links in the documentation are written without a trailing slash.
Because the site serves pages as directories, every one of those links triggers
a redirect and that redirect drops the connection to plain HTTP before a
second redirect puts it back on HTTPS.

### Example

https://docs.dyalog.com/20.0/windows-ui-guide/find-and-replace-dialogs/ links to:

https://docs.dyalog.com/20.0/language-reference-guide/pcre-specifications

with no trailing slash. Requesting it produces:

301 -> http://docs.dyalog.com/20.0/language-reference-guide/pcre-specifications/
301 -> https://docs.dyalog.com/20.0/language-reference-guide/pcre-specifications/

Verify with:

curl -IL https://docs.dyalog.com/20.0/language-reference-guide/pcre-specifications

The response headers show the redirect through HTTP:

HTTP/1.1 301 Moved Permanently
location: http://docs.dyalog.com/20.0/language-reference-guide/pcre-specifications/

followed by a redirect back to HTTPS.

The same slashless link to `pcre-specifications` also appears on
https://docs.dyalog.com/20.0/windows-ui-guide/find-objects-tool/, and
https://docs.dyalog.com/20.0/windows-installation-and-configuration-guide/configuration-parameters/configuration-parameters/
links to https://docs.dyalog.com/20.0/object-reference/methodorevents/getenvironment
in the same way.

### Scale

From a Screaming Frog crawl of v20.0 (2026-09-08):

- 616 internal links across 259 pages point at slashless URLs
- 299 unique URLs affected
- 625 two-redirect chains and 16 three-redirect chains
- 603 internal 3xx responses in total, about 15% of all internal requests

### What it causes

- An unencrypted request and response in the middle of the chain. The site
sends no `Strict-Transport-Security` header, so browsers have no instruction
to skip the HTTP hop.
- Three round trips instead of one, for readers and for crawlers.
- Some HTTP clients abandon the request entirely, returning "too many
redirects" rather than the page.

### Fix

Add the trailing slash to internal links in the source markdown. The redirect
then never fires and the insecure hop disappears, without any infrastructure
change.

### Related, separate issue

The reason the redirect is insecure at all is that the server writes `http://`
into the `Location` header regardless of how the request arrived — most likely
TLS terminating at a proxy that forwards to the origin over HTTP, with the
origin building absolute redirect URLs from its own scheme rather than
`X-Forwarded-Proto`. This affects https://docs.dyalog.com/ itself, which
redirects to `http://docs.dyalog.com/20.0/` before being upgraded again, so it
will still need fixing after the links are corrected. That is a hosting
configuration matter rather than a content one.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.