Default to HTTPS for all Gravatar URLsdefault-to-https-for-gravatar-urls

If using gravatar.com, both plain_url and ssl_url in settings are now
served via HTTPS. Make this the default.

15 files changed, 63 insertions, 56 deletions

diff --git a/app/views/profiles/show.html.haml b/app/views/profiles/show.html.haml
index 0f773933ac2..5c76d2d8f51 100644
--- a/app/views/profiles/show.html.haml
+++ b/app/views/profiles/show.html.haml
@@ -13,11 +13,11 @@
         - if @user.avatar?
           You can change your avatar here
           - if gravatar_enabled?
-            or remove the current avatar to revert to #{link_to Gitlab.config.gravatar.host, 'http://' + Gitlab.config.gravatar.host}
+            or remove the current avatar to revert to #{link_to Gitlab.config.gravatar.host, 'https://' + Gitlab.config.gravatar.host}
         - else
           You can upload an avatar here
           - if gravatar_enabled?
-            or change it at #{link_to Gitlab.config.gravatar.host, 'http://' + Gitlab.config.gravatar.host}
+            or change it at #{link_to Gitlab.config.gravatar.host, 'https://' + Gitlab.config.gravatar.host}
     .col-lg-8
       .clearfix.avatar-image.append-bottom-default
         = link_to avatar_icon(@user, 400), target: '_blank', rel: 'noopener noreferrer' do
diff --git a/changelogs/unreleased/default-to-https-for-gravatar-urls.yml b/changelogs/unreleased/default-to-https-for-gravatar-urls.yml
new file mode 100644
index 00000000000..544c34fe31d
--- /dev/null
+++ b/changelogs/unreleased/default-to-https-for-gravatar-urls.yml
@@ -0,0 +1,5 @@
+---
+title: Default to HTTPS for all Gravatar URLs
+merge_request: 16666
+author:
+type: fixed
diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
index f2f05b3eeb2..238e1583770 100644
--- a/config/gitlab.yml.example
+++ b/config/gitlab.yml.example
@@ -175,10 +175,12 @@ production: &base
     host: 'https://mattermost.example.com'
 
   ## Gravatar
-  ## For Libravatar see: http://doc.gitlab.com/ce/customization/libravatar.html
+  ## If using gravatar.com, there's nothing to change here. For Libravatar
+  ## you'll need to provide the custom URLs. For more information,
+  ## see: https://docs.gitlab.com/ee/customization/libravatar.html
   gravatar:
-    # gravatar urls: possible placeholders: %{hash} %{size} %{email} %{username}
-    # plain_url: "http://..."     # default: http://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
+    # Gravatar/Libravatar URLs: possible placeholders: %{hash} %{size} %{email} %{username}
+    # plain_url: "http://..."     # default: https://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
     # ssl_url:   "https://..."    # default: https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon
 
   ## Auxiliary jobs
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index abc992e49dc..899e612ffbd 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -350,7 +350,7 @@ Settings.mattermost['host'] = nil unless Settings.mattermost.enabled
 #
 Settings['gravatar'] ||= Settingslogic.new({})
 Settings.gravatar['enabled']      = true if Settings.gravatar['enabled'].nil?
-Settings.gravatar['plain_url']  ||= 'http://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon'
+Settings.gravatar['plain_url']  ||= 'https://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon'
 Settings.gravatar['ssl_url']    ||= 'https://secure.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon'
 Settings.gravatar['host']         = Settings.host_without_www(Settings.gravatar['plain_url'])
 
diff --git a/spec/fixtures/emails/attachment.eml b/spec/fixtures/emails/attachment.eml
index f25c3d1a449..b3a30b3221b 100644
--- a/spec/fixtures/emails/attachment.eml
+++ b/spec/fixtures/emails/attachment.eml
@@ -91,7 +91,7 @@ x #ccc solid;padding-left:1ex"><div>
 adding=3D"0" border=3D"0"><tbody>
 <tr>
 <td style=3D"vertical-align:top;width:55px">
-        <img src=3D"http://www.gravatar.com/avatar/42776c4982dff1fa45ee8248=
+        <img src=3D"https://www.gravatar.com/avatar/42776c4982dff1fa45ee8248=
 532f8ad0.png?s=3D45&amp;r=3Dpg&amp;d=3Didenticon" title=3D"Neil" style=3D"m=
 ax-width:694px" width=3D"45" height=3D"45">
 </td>
@@ -121,7 +121,7 @@ nk">@eviltrout</a> Any idea why it showed up in suggested topics? </p>
 <div style=3D"color:#666">
     <p>To respond, reply to this email or visit <a href=3D"http://meta.disc=
 ourse.org/t/spam-post-pops-back-up-in-suggested-topics/11005/5" style=3D"co=
-lor:#666" target=3D"_blank">http://meta.discourse.org/t/spam-post-pops-back=
+lor:#666" target=3D"_blank">https://meta.discourse.org/t/spam-post-pops-back=
 -up-in-suggested-topics/11005/5</a> in your browser.</p>
 
   </div>
@@ -132,12 +132,12 @@ lor:#666" target=3D"_blank">http://meta.discourse.org/t/spam-post-pops-back=
 lpadding=3D"0" border=3D"0"><tbody>
 <tr>
 <td style=3D"vertical-align:top;width:55px">
-        <img src=3D"http://www.gravatar.com/avatar/42776c4982dff1fa45ee8248=
+        <img src=3D"https://www.gravatar.com/avatar/42776c4982dff1fa45ee8248=
 532f8ad0.png?s=3D45&amp;r=3Dpg&amp;d=3Didenticon" title=3D"Neil" style=3D"m=
 ax-width:694px" width=3D"45" height=3D"45">
 </td>
       <td>
-        <a href=3D"http://meta.discourse.org/users/neil" style=3D"font-size=
+        <a href=3D"https://meta.discourse.org/users/neil" style=3D"font-size=
 :13px;font-family:&#39;lucida grande&#39;,tahoma,verdana,arial,sans-serif;c=
 olor:#3b5998;text-decoration:none;font-weight:bold" target=3D"_blank">Neil<=
 /a><br>
@@ -155,12 +155,12 @@ vember 19</span>
 adding=3D"0" border=3D"0"><tbody>
 <tr>
 <td style=3D"vertical-align:top;width:55px">
-        <img src=3D"http://www.gravatar.com/avatar/5120fc4e345db0d1a9648882=
+        <img src=3D"https://www.gravatar.com/avatar/5120fc4e345db0d1a9648882=
 72073819.png?s=3D45&amp;r=3Dpg&amp;d=3Didenticon" title=3D"riking" style=3D=
 "max-width:694px" width=3D"45" height=3D"45">
 </td>
       <td>
-        <a href=3D"http://meta.discourse.org/users/riking" style=3D"font-si=
+        <a href=3D"https://meta.discourse.org/users/riking" style=3D"font-si=
 ze:13px;font-family:&#39;lucida grande&#39;,tahoma,verdana,arial,sans-serif=
 ;color:#3b5998;text-decoration:none;font-weight:bold" target=3D"_blank">rik=
 ing</a><br>
@@ -173,7 +173,7 @@ vember 19</span>
 <td style=3D"padding-top:5px" colspan=3D"2">
 <p style=3D"margin-top:0"><u></u></p><div>
 <div></div>
-<img width=3D"20" height=3D"20" src=3D"http://www.gravatar.com/avatar/51d62=
+<img width=3D"20" height=3D"20" src=3D"https://www.gravatar.com/avatar/51d62=
 3f33f8b83095db84ff35e15dbe8.png?s=3D40&amp;r=3Dpg&amp;d=3Didenticon" style=
 =3D"max-width:694px">codinghorror:</div>
 <blockquote><p style=3D"margin-top:0">I can&#39;t even find that topic by n=
@@ -193,12 +193,12 @@ uld be invisible to me, and not showing up in Suggested Topics.</p>
 adding=3D"0" border=3D"0"><tbody>
 <tr>
 <td style=3D"vertical-align:top;width:55px">
-        <img src=3D"http://www.gravatar.com/avatar/51d623f33f8b83095db84ff3=
+        <img src=3D"https://www.gravatar.com/avatar/51d623f33f8b83095db84ff3=
 5e15dbe8.png?s=3D45&amp;r=3Dpg&amp;d=3Didenticon" title=3D"codinghorror" st=
 yle=3D"max-width:694px" width=3D"45" height=3D"45">
 </td>
       <td>
-        <a href=3D"http://meta.discourse.org/users/codinghorror" style=3D"f=
+        <a href=3D"https://meta.discourse.org/users/codinghorror" style=3D"f=
 ont-size:13px;font-family:&#39;lucida grande&#39;,tahoma,verdana,arial,sans=
 -serif;color:#3b5998;text-decoration:none;font-weight:bold" target=3D"_blan=
 k">codinghorror</a><br>
@@ -219,12 +219,12 @@ rout" target=3D"_blank">@eviltrout</a>? I can&#39;t even find that topic by=
 adding=3D"0" border=3D"0"><tbody>
 <tr>
 <td style=3D"vertical-align:top;width:55px">
-        <img src=3D"http://www.gravatar.com/avatar/5120fc4e345db0d1a9648882=
+        <img src=3D"https://www.gravatar.com/avatar/5120fc4e345db0d1a9648882=
 72073819.png?s=3D45&amp;r=3Dpg&amp;d=3Didenticon" title=3D"riking" style=3D=
 "max-width:694px" width=3D"45" height=3D"45">
 </td>
       <td>
-        <a href=3D"http://meta.discourse.org/users/riking" style=3D"font-si=
+        <a href=3D"https://meta.discourse.org/users/riking" style=3D"font-si=
 ze:13px;font-family:&#39;lucida grande&#39;,tahoma,verdana,arial,sans-serif=
 ;color:#3b5998;text-decoration:none;font-weight:bold" target=3D"_blank">rik=
 ing</a><br>
@@ -241,7 +241,7 @@ lar spam post, and it was promptly deleted/hidden, but it just popped up in=
 
 <p style=3D"margin-top:0"></p>
 <div><a href=3D"//cdn.discourse.org/uploads/meta_discourse/2158/50b8b49557c=
-b249e.png" target=3D"_blank"><img src=3D"http://cdn.discourse.org/uploads/m=
+b249e.png" target=3D"_blank"><img src=3D"https://cdn.discourse.org/uploads/m=
 eta_discourse/_optimized/ab1/c92/acd2c33402_584x134.png" width=3D"584" heig=
 ht=3D"134" style=3D"max-width:694px"><div>
 
@@ -257,12 +257,12 @@ ht=3D"134" style=3D"max-width:694px"><div>
 <div style=3D"color:#666">
 <p>To respond, reply to this email or visit <a href=3D"http://meta.discours=
 e.org/t/spam-post-pops-back-up-in-suggested-topics/11005/5" style=3D"color:=
-#666" target=3D"_blank">http://meta.discourse.org/t/spam-post-pops-back-up-=
+#666" target=3D"_blank">https://meta.discourse.org/t/spam-post-pops-back-up-=
 in-suggested-topics/11005/5</a> in your browser.</p>
 
 </div>
 <div style=3D"color:#666">
-<p>To unsubscribe from these emails, visit your <a href=3D"http://meta.disc=
+<p>To unsubscribe from these emails, visit your <a href=3D"https://meta.disc=
 ourse.org/user_preferences" style=3D"color:#666" target=3D"_blank">user pre=
 ferences</a>.</p>
 </div>
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 5c5d53877a6..da0343588ef 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -117,7 +117,7 @@ describe ApplicationHelper do
         stub_config_setting(https: false)
 
         expect(helper.gravatar_icon(user_email))
-          .to match('http://www.gravatar.com/avatar/b58c6f14d292556214bd64909bcdb118')
+          .to match('https://www.gravatar.com/avatar/b58c6f14d292556214bd64909bcdb118')
       end
 
       it 'uses HTTPs when configured' do
diff --git a/spec/initializers/settings_spec.rb b/spec/initializers/settings_spec.rb
index a11824d0ac5..838ca9fabef 100644
--- a/spec/initializers/settings_spec.rb
+++ b/spec/initializers/settings_spec.rb
@@ -24,7 +24,7 @@ describe Settings do
         expect(described_class.host_without_www('http://foo.com')).to eq 'foo.com'
         expect(described_class.host_without_www('http://www.foo.com')).to eq 'foo.com'
         expect(described_class.host_without_www('http://secure.foo.com')).to eq 'secure.foo.com'
-        expect(described_class.host_without_www('http://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon')).to eq 'gravatar.com'
+        expect(described_class.host_without_www('https://www.gravatar.com/avatar/%{hash}?s=%{size}&d=identicon')).to eq 'gravatar.com'
 
         expect(described_class.host_without_www('https://foo.com')).to eq 'foo.com'
         expect(described_class.host_without_www('https://www.foo.com')).to eq 'foo.com'
diff --git a/spec/javascripts/environments/environment_item_spec.js b/spec/javascripts/environments/environment_item_spec.js
index 0e141adb628..7a34126eef7 100644
--- a/spec/javascripts/environments/environment_item_spec.js
+++ b/spec/javascripts/environments/environment_item_spec.js
@@ -68,7 +68,7 @@ describe('Environment item', () => {
             username: 'root',
             id: 1,
             state: 'active',
-            avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
+            avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
             web_url: 'http://localhost:3000/root',
           },
           commit: {
@@ -84,7 +84,7 @@ describe('Environment item', () => {
               username: 'root',
               id: 1,
               state: 'active',
-              avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
+              avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
               web_url: 'http://localhost:3000/root',
             },
             commit_path: '/root/ci-folders/tree/500aabcb17c97bdcf2d0c410b70cb8556f0362dd',
diff --git a/spec/javascripts/fixtures/projects.json b/spec/javascripts/fixtures/projects.json
index 1339ee00870..68a150f602a 100644
--- a/spec/javascripts/fixtures/projects.json
+++ b/spec/javascripts/fixtures/projects.json
@@ -14,7 +14,7 @@
     "username": "root",
     "id": 1,
     "state": "active",
-    "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon",
+    "avatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon",
     "web_url": "http://localhost:3000/u/root"
   },
   "name": "test",
diff --git a/spec/javascripts/helpers/user_mock_data_helper.js b/spec/javascripts/helpers/user_mock_data_helper.js
index a9783ea065c..323fee3767e 100644
--- a/spec/javascripts/helpers/user_mock_data_helper.js
+++ b/spec/javascripts/helpers/user_mock_data_helper.js
@@ -4,7 +4,7 @@ export default {
     for (let i = 0; i < numberUsers; i = i += 1) {
       users.push(
         {
-          avatar: 'http://gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
+          avatar: 'https://gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
           id: (i + 1),
           name: `GitLab User ${i}`,
           username: `gitlab${i}`,
diff --git a/spec/javascripts/jobs/mock_data.js b/spec/javascripts/jobs/mock_data.js
index 43532275121..43589d54be4 100644
--- a/spec/javascripts/jobs/mock_data.js
+++ b/spec/javascripts/jobs/mock_data.js
@@ -37,7 +37,7 @@ export default {
     username: 'root',
     id: 1,
     state: 'active',
-    avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
+    avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
     web_url: 'http://localhost:3000/root',
   },
   erase_path: '/root/ci-mock/-/jobs/4757/erase',
@@ -54,7 +54,7 @@ export default {
       username: 'root',
       id: 1,
       state: 'active',
-      avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
+      avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
       web_url: 'http://localhost:3000/root',
     },
     active: false,
@@ -107,10 +107,10 @@ export default {
         username: 'root',
         id: 1,
         state: 'active',
-        avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
+        avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
         web_url: 'http://localhost:3000/root',
       },
-      author_gravatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
+      author_gravatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80\u0026d=identicon',
       commit_url: 'http://localhost:3000/root/ci-mock/commit/c58647773a6b5faf066d4ad6ff2c9fbba5f180f6',
       commit_path: '/root/ci-mock/commit/c58647773a6b5faf066d4ad6ff2c9fbba5f180f6',
     },
diff --git a/spec/javascripts/notes/mock_data.js b/spec/javascripts/notes/mock_data.js
index b020a1020df..f0c800c759d 100644
--- a/spec/javascripts/notes/mock_data.js
+++ b/spec/javascripts/notes/mock_data.js
@@ -107,7 +107,7 @@ export const note = {
     "name": "Administrator",
     "username": "root",
     "state": "active",
-    "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
+    "avatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
     "path": "/root"
   },
   "created_at": "2017-08-10T15:24:03.087Z",
diff --git a/spec/javascripts/sidebar/mock_data.js b/spec/javascripts/sidebar/mock_data.js
index 7bc591d2d47..d9e84e35f69 100644
--- a/spec/javascripts/sidebar/mock_data.js
+++ b/spec/javascripts/sidebar/mock_data.js
@@ -27,7 +27,7 @@ const RESPONSE_MAP = {
           username: 'user0',
           id: 22,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/52e4ce24a915fb7e51e1ad3b57f4b00a?s=80\u0026d=identicon',
+          avatar_url: 'https://www.gravatar.com/avatar/52e4ce24a915fb7e51e1ad3b57f4b00a?s=80\u0026d=identicon',
           web_url: 'http: //localhost:3001/user0',
         },
         {
@@ -35,7 +35,7 @@ const RESPONSE_MAP = {
           username: 'tajuana',
           id: 18,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/4852a41fb41616bf8f140d3701673f53?s=80\u0026d=identicon',
+          avatar_url: 'https://www.gravatar.com/avatar/4852a41fb41616bf8f140d3701673f53?s=80\u0026d=identicon',
           web_url: 'http: //localhost:3001/tajuana',
         },
         {
@@ -43,7 +43,7 @@ const RESPONSE_MAP = {
           username: 'michaele.will',
           id: 16,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/e301827eb03be955c9c172cb9a8e4e8a?s=80\u0026d=identicon',
+          avatar_url: 'https://www.gravatar.com/avatar/e301827eb03be955c9c172cb9a8e4e8a?s=80\u0026d=identicon',
           web_url: 'http: //localhost:3001/michaele.will',
         },
       ],
@@ -72,24 +72,24 @@ const RESPONSE_MAP = {
           username: 'user0',
           id: 22,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/52e4ce24a915fb7e51e1ad3b57f4b00a?s=80\u0026d=identicon',
-          web_url: 'http: //localhost:3001/user0',
+          avatar_url: 'https://www.gravatar.com/avatar/52e4ce24a915fb7e51e1ad3b57f4b00a?s=80\u0026d=identicon',
+          web_url: 'http://localhost:3001/user0',
         },
         {
           name: 'Marguerite Bartell',
           username: 'tajuana',
           id: 18,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/4852a41fb41616bf8f140d3701673f53?s=80\u0026d=identicon',
-          web_url: 'http: //localhost:3001/tajuana',
+          avatar_url: 'https://www.gravatar.com/avatar/4852a41fb41616bf8f140d3701673f53?s=80\u0026d=identicon',
+          web_url: 'http://localhost:3001/tajuana',
         },
         {
           name: 'Laureen Ritchie',
           username: 'michaele.will',
           id: 16,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/e301827eb03be955c9c172cb9a8e4e8a?s=80\u0026d=identicon',
-          web_url: 'http: //localhost:3001/michaele.will',
+          avatar_url: 'https://www.gravatar.com/avatar/e301827eb03be955c9c172cb9a8e4e8a?s=80\u0026d=identicon',
+          web_url: 'http://localhost:3001/michaele.will',
         },
       ],
       human_time_estimate: null,
@@ -100,24 +100,24 @@ const RESPONSE_MAP = {
           username: 'user0',
           id: 22,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/52e4ce24a915fb7e51e1ad3b57f4b00a?s=80\u0026d=identicon',
-          web_url: 'http: //localhost:3001/user0',
+          avatar_url: 'https://www.gravatar.com/avatar/52e4ce24a915fb7e51e1ad3b57f4b00a?s=80\u0026d=identicon',
+          web_url: 'http://localhost:3001/user0',
         },
         {
           name: 'Marguerite Bartell',
           username: 'tajuana',
           id: 18,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/4852a41fb41616bf8f140d3701673f53?s=80\u0026d=identicon',
-          web_url: 'http: //localhost:3001/tajuana',
+          avatar_url: 'https://www.gravatar.com/avatar/4852a41fb41616bf8f140d3701673f53?s=80\u0026d=identicon',
+          web_url: 'http://localhost:3001/tajuana',
         },
         {
           name: 'Laureen Ritchie',
           username: 'michaele.will',
           id: 16,
           state: 'active',
-          avatar_url: 'http: //www.gravatar.com/avatar/e301827eb03be955c9c172cb9a8e4e8a?s=80\u0026d=identicon',
-          web_url: 'http: //localhost:3001/michaele.will',
+          avatar_url: 'https://www.gravatar.com/avatar/e301827eb03be955c9c172cb9a8e4e8a?s=80\u0026d=identicon',
+          web_url: 'http://localhost:3001/michaele.will',
         },
       ],
       subscribed: true,
@@ -182,7 +182,7 @@ const mockData = {
       id: 1,
       name: 'Administrator',
       username: 'root',
-      avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
+      avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
     },
     rootPath: '/',
     fullPath: '/gitlab-org/gitlab-shell',
@@ -194,7 +194,7 @@ const mockData = {
     human_total_time_spent: null,
   },
   user: {
-    avatar: 'http://gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
+    avatar: 'https://gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
     id: 1,
     name: 'Administrator',
     username: 'root',
diff --git a/spec/javascripts/sidebar/sidebar_store_spec.js b/spec/javascripts/sidebar/sidebar_store_spec.js
index ea4eae1e23f..3591f96ff87 100644
--- a/spec/javascripts/sidebar/sidebar_store_spec.js
+++ b/spec/javascripts/sidebar/sidebar_store_spec.js
@@ -6,14 +6,14 @@ const ASSIGNEE = {
   id: 2,
   name: 'gitlab user 2',
   username: 'gitlab2',
-  avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
+  avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
 };
 
 const ANOTHER_ASSINEE = {
   id: 3,
   name: 'gitlab user 3',
   username: 'gitlab3',
-  avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
+  avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
 };
 
 const PARTICIPANT = {
@@ -38,7 +38,7 @@ describe('Sidebar store', () => {
         id: 1,
         name: 'Administrator',
         username: 'root',
-        avatar_url: 'http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
+        avatar_url: 'https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon',
       },
       editable: true,
       rootPath: '/',
diff --git a/spec/javascripts/vue_mr_widget/mock_data.js b/spec/javascripts/vue_mr_widget/mock_data.js
index ae494267659..3dd75307484 100644
--- a/spec/javascripts/vue_mr_widget/mock_data.js
+++ b/spec/javascripts/vue_mr_widget/mock_data.js
@@ -38,7 +38,7 @@ export default {
       "username": "root",
       "id": 1,
       "state": "active",
-      "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
+      "avatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
       "web_url": "http://localhost:3000/root"
     },
     "merged_at": "2017-04-07T15:39:25.696Z",
@@ -50,7 +50,7 @@ export default {
     "username": "root",
     "id": 1,
     "state": "active",
-    "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
+    "avatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
     "web_url": "http://localhost:3000/root"
   },
   "merge_user": null,
@@ -64,7 +64,7 @@ export default {
       "username": "root",
       "id": 1,
       "state": "active",
-      "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
+      "avatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
       "web_url": "http://localhost:3000/root"
     },
     "active": false,
@@ -159,10 +159,10 @@ export default {
         "username": "root",
         "id": 1,
         "state": "active",
-        "avatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
+        "avatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
         "web_url": "http://localhost:3000/root"
       },
-      "author_gravatar_url": "http://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
+      "author_gravatar_url": "https://www.gravatar.com/avatar/e64c7d89f26bd1972efa854d13d7dd61?s=80&d=identicon",
       "commit_url": "http://localhost:3000/root/acets-app/commit/104096c51715e12e7ae41f9333e9fa35b73f385d",
       "commit_path": "/root/acets-app/commit/104096c51715e12e7ae41f9333e9fa35b73f385d"
     },