Is document.location.protocol ever invalid?
<p>I want to construct URLs with the same scheme (presumably, "http:" or "https:") as the page that loaded the currently-running JavaScript. Modern browsers support simply omitting the scheme (for example, <code>src="//example.com/test.js"</code>), but this isn't fully cross-browser compatible. (I've read that IE 6 is the only browser that doesn't support it, but I still need compatibility with that version.)</p>

<p>The cross-browser way to do this seems to be to check <code>document.location.protocol</code>. For example, Google Analytics uses:</p>

<pre><code>('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + ...
</code></pre>

<p>In Google's case, they wanted to use different domains depending on whether the request uses SSL, so that pattern makes sense. But I've seen others use the same pattern when only the scheme is changing:</p>

<pre><code>('https:' == document.location.protocol ? 'https:' : 'http:') + "//example.com"
</code></pre>

<p>(One example is in the "Final Wufoo Snippet" at <a href="http://css-tricks.com/thinking-async/" rel="nofollow">http://css-tricks.com/thinking-async/</a>.)</p>

<p>I'd prefer to use this simpler expression instead:</p>

<pre><code>document.location.protocol + "//example.com"
</code></pre>

<p>Should I really be concerned about the possibility of <code>document.location.protocol</code> taking on some value other than "https:" or "http:" when my code is used on sites I don't control?</p>
