Use of non-canonical license URIs

[fkohrt]

Description

The canonical URIs of the CC licenses all start with http://, as can be verified by the RDF source of truth. The scheme is part of the URI, so there's a semantic difference between http://creativecommons.org/licenses/by/4.0/ and https://creativecommons.org/licenses/by/4.0/.

Browsers tend to prefer the HTTPS version of a site anyways (Firefox: HTTPS-Only Mode, Chromium: upgraded HTTPS navigations), so this is increasingly unlikely to be a security/privacy issue.

Reproduction

See e.g. here, where additionally chooserRef is appended:

chooser/src/utils/license-utilities.js

Lines 62 to 79 in 21cde4b

	const chooserRef = '?ref=chooser-v1'
	/**
	* Returns url to license from short license name with version number (eg. 'CC BY 4.0')
	* @param {LicenseAttributes} attr license attributes object
	* @param {'web'|'print'} mode? (?ref=chooser-v1, target and rel are added to the end of the link if mode is web)
	* @returns {string} url of the license information page
	*/
	function licenseURL(attr, mode = 'web') {
	if (attr.BY === undefined) throw new Error('Cannot return URL when BY attribute is undefined')
	const linkRef = mode === 'web' ? chooserRef : ''
	if (attr.BY === false) {
	return `https://creativecommons.org/publicdomain/zero/1.0${linkRef}`
	}
	let short = attrToShort(attr).toLowerCase().slice(3)
	short = short.slice(0, short.length - 4)
	return `https://creativecommons.org/licenses/${short}/4.0${linkRef}`
	}

Or here, where also a trailing slash is missing:

chooser/src/utils/licenses.js

Line 31 in d61ff90

URL: 'https://creativecommons.org/licenses/by/4.0',

Other instances are tests/unit/specs/components/LicenseHTML.spec.js and tests/e2e/specs/LicenseDetailsCard.js.

Expectation

Use the license URIs from the RDF datastore at cc.licenserdf.

Additional context

There are two ongoing discussions about making canonical URIs more prominent at other places:

• make canonical URIs more visible on the website cc-legal-tools-app#361
• License URIs use http uri scheme, not https cc-archive/cc.licenserdf#7

[obulat]

Thank you for bringing this issue up, @fkohrt ! I will respond as soon as we have discussed this issue with the other members of the team.

[fkohrt]

I believe this can be closed due to cc-archive/cc.licenserdf#7 (comment):

Add owl:sameAs element with HTTPS URL

[TimidRobot]

This was resolved by the production release of the new CC Legal Tools (creativecommons/cc-legal-tools-app & creativecommons/cc-legal-tools-data), that include owl:sameAs, on 2023-09-27.