Force HTTPS on HttpLoader

[filip26]

Is your feature request related to a problem? Please describe.
HttpLoader does not distinguish between http and https.

Describe the solution you'd like

HtttpLoader.defaultInstance().httpsOnly()

Describe alternatives you've considered
Wrapping custom DocumentLoader enforcer. e.g. SchemeRouter

[skodapetr]

Could we just remove "http" from SchemaRouter to get the same effect, that is to disable http?

[filip26]

@skodapetr that's not the same as allowing to enforce it. e.g. You can pass DefaultHttpLoader directly as a document loader, no need to wrap into SchemaRouter if you don't intend to support more protocols.

[skodapetr]

So the idea is to add a "switch" httpsOnly to DefaultHttpLoader. When switch on, every http request is replaced with https request. Is that correct?

Should there be a method to turn this back off?

[filip26]

So the idea is to add a "switch" httpsOnly to DefaultHttpLoader. When switch on, every http request is replaced with https request. Is that correct?

that's one option, I'm thinking about extending HttpClient interface of a new getter/setter.

 setHttpsPolicy(Optional|Required|Enforced);

Optional - same as now, both http and https get through
Required - http requests are rejected, an exception is thrown
Enforced - http requests are rewritten to https