What is the shortest way to secure a site with Javascript?

I am new to Code Golfing, and this is what I've come up with so far. I bet that this could be improved though:

Challenge:

Make a script which redirects http:// to https:// with the least bytes of code

Attempts:

Original code (150ish BYTES!):

if (window.location.protocol != "https:") {
window.location.href =
"https:" + window.location.href.substring(window.location.protocol.length);
}


My code so far (68 bytes):

var l=location;':'==l.protocol[4]&&(l.href=l.href.replace(':','s:'))


Updated, thanks to @mypronounismonicareinstate (52 bytes):

l=location;l["protocol"][5]||(l["protocol"]="https")


Thanks to @arnauld (45 bytes):

(l=location)[p='protocol'][5]||(l[p]='https')


This works, thanks to @anderskaseorg (38 bytes):

with(location)protocol='https'+href[4]


However, this last answer would not be commonly used on a real site

Could this be minified more?

• I think you want the code-golf tag, and also check out the Sandbox. Good luck! – user Aug 8 '20 at 15:25
• I think the == can be replaced by < (because ":" < "s"). You might also be able to skip the var (because if the rest of the code doesn't use global variables, this will only help find bugs!). – the default. Aug 8 '20 at 15:43
• @mypronounismonicareinstate which leads to (l=location)[p='protocol'][5]||(l[p]='https') (45 bytes) – Arnauld Aug 8 '20 at 15:59
• Note this won't make your site more secure, because the evil attacker will just delete your script as part of the attack. – user253751 Aug 9 '20 at 15:44
• Just to make this perfectly clear: this site is about recreational programming competitions, where only the winning criterion matters (the code size in that case). If you are really looking for a clean, reliable, cross-platform compatible way to perform this task (or any other task), you definitely shouldn't be asking here. – Arnauld Aug 10 '20 at 5:35

39 38 bytes

with(location)protocol='https'+href[4]


How it works

• If location.href starts with http:, this assigns location.protocol = 'https:'.
• If location.href starts with https:, this assigns location.protocol = 'httpss'. According to the specification, this should have no effect because httpss is neither http nor https. Firefox obeys this specification. Chrome seems to try to find an external app to open the httpss scheme (bug).
• Use of with is not recommended for websites. Alternative (a byte longer): (l=location).protocol='https'+l.href[4]. – vrintle Aug 9 '20 at 5:52
• @RahulVerma This is code-golf; anything that works is fair game. If you’re looking for recommended advice, stay far, far away from this entire site. – Anders Kaseorg Aug 9 '20 at 5:56
• Despite of the fact that this site isn't suitable for recommended solution, with has bugs and compatibility issues, due to which it may fail in some browsers. – vrintle Aug 9 '20 at 6:56
• @RahulVerma Read your link more carefully: with does not have bugs and compatibility issues, it may be the source of bugs and compatibility issues. If you read farther down, the described issues are in code you might write using with that’s confusing to humans or that might break unintuitively as JS evolves. These are valid criticisms of with—you should never use it—but, again, this site has nothing to do with “should”. The with statement itself behaves correctly as defined by the specification, and will not be changed; my use of with is not affected by these issues. – Anders Kaseorg Aug 9 '20 at 7:22
• This seems ok, but it says cannot open page – derder56 Aug 9 '20 at 13:44