How safe is it to use `//domain.com/` (schema-less) links? [duplicate]

Question

I've read some articles before that stated you can skip the scheme from your URLs and it'd be automatically determined from the page you're visiting. For example, if you're on https://test.com/ and you'd have an image like //google.com/logo.png, the image would be requested through a secure connection. Unfortunately, I can't find any reference right now (damn you, bookmarks!).

I tried it in Chrome and it worked. Tested on https://google.com:

(function (document) {
    var img = document.createElement('img');
    img.src = '//www.paypal.com/en_US/i/logo/paypal_logo.gif';
    document.body.appendChild(img);
})(document);

Inspecting the elements, it brings in the logo from https://www.paypal.com.

I've skimmed the URL RFC but haven't found anything that clearly states this behavior. Does anyone know what the browser support for this feature is? I'm especially interested in mobile browsers.

Answer 1

This is well supported by all browsers and is called schemaless URLs.

See Can I change all my http:// links to just //? for more detail.