<!-- The third rule here rewrites profile picture URLs to follow a
     pattern that Twitter currently uses itself, but inconsistently. 
     Using this pattern now makes most user pages load successfully
     in HTTPS instead of giving a mixed content warning. -->

<!-- There are still some hosts that things get loaded from that can't
     be safely rewritten without triggering a certificate error.
     E.g. platform.twitter.com has some scripts, but the https version
     won't validate. -->

<!-- The twimg rule triggers the favicon bug a lot but it's not clear
     that it makes the site unusable or particularly broken. -->

<ruleset name="Twitter">
  <target host="*.twitter.com" />
  <target host="twitter.com" />
  <target host="*.twimg.com" />

  <securecookie host="^(.*\.)twitter\.com$" name=".*" />
  
  <rule from="^http://(www\.)?twitter\.com/" to="https://twitter.com/"/>
  <rule from="^http://(search|static)\.twitter\.com/" to="https://$1.twitter.com/"/>
  <rule from="^http://[a-z0-9][^@:/]?\.twimg\.com/" to="https://s3.amazonaws.com/twitter_production/"/>
</ruleset>
