jQuery CDN reference in SP Online MasterPage changed magically

Question

My custom MasterPage deployed to SharePoint Online contains two links to JavaScript libraries on CDN's. Like this:

<script type="text/javascript" src="//code.jquery.com/jquery-1.11.0.min.js"></script>
<script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/knockout/3.4.0/knockout-debug.js"></script>

When deployed this works like it's supposed to. But after some time (days?) there is a change in the MasterPage to:

<script type="text/javascript" src="/[MySiteCollection]///code.jquery.com/jquery-1.11.0.min.js"></script>
<script type="text/javascript" src="/[MySiteCollection]///cdnjs.cloudflare.com/ajax/libs/knockout/3.4.0/knockout-debug.js"></script>

This breaks the link to both CDN locations while the Modified date is exactly what it was after deployment. SharePoint doesn't indicate any changes to the MasterPage by either a system account or a user account. But the change is done inside the MasterPage verified by downloading a copy of the MasterPage. Something must have changed the file without SharePoint notifying me of the change.

Is SharePoint Online changing my URL's here?

Answer 1

SharePoint has difficulties dealing with protocol-less URLs. Have you tried changing them to https?

Answer 2

It is not SharePoint Online ... It is SharePoint changing your URIs

Cause

SharePoint takes hold of all relative URIs

Origin is the Publishing code where you can move any hyperlinked page in a SharePoint Libary to another library and SP will change any relative reference in other files

Which is fine for ASPX pages and the relative links you have. But SharePoint does this to any filetype it can read/parse... HTML files.. TXT files..

We had a problem with .MHT files created by Excel (Microsofts way of stuffing a whole website in one file)
SP Publishing rewrites all relative URLs, and all we could do was put the file in a NON-Publising site

So...your MasterPage is under Publishing control...

Your issue & solution

//code.jquery.com/jquery-1.11.0.min.js
//cdnjs.cloudflare.com/ajax/libs/knockout/3.4.0/knockout-debug.js

Are Not Absolute URIs .. they are Relative URIs !
so SharePoint (Publishing) thinks it may take hold of them

This relative notation prevents Mixed Content issues, if the current page was served over HTTP the network call to read the JS file will be made with HTTP. (likewise for HTTPS)

So your solution is:

https://code.jquery.com/jquery-1.11.0.min.js
https://cdnjs.cloudflare.com/ajax/libs/knockout/3.4.0/knockout-debug.js

There won't be Mixed Content issues, because SPOnline always serves content over HTTPS

Update #1

Microsoft (and MVPs) strongly advice one not to customize SharePoint Online the (old) MasterPage way.

You can add scriptfiles as Custom Actions, use the Chrome Extension: SP Editor
(but not in Modern Experiences)