In Safari, why does S3 redirect gi… | Apple Developer Forums

In Safari, why does S3 redirect give "not secure" page?

I'm asking about this here, because I only get this behavior in Safari — it works as I expect in Chrome.

Safari 14.0.3
macOS Mojave 10.14.6

I have an S3 static website, <wiltonzba.org>, served via CloudFront. The site has a subdirectory, ordinance, containing both the current and archived versions of a zoning ordinance:

Code Block ordinance/
    index.html
    ordinance_01.html
    ordinance_02.html
    ...
    ordinance_2019/
        index.html
        ordinance_01.html
        ordinance_02.html
        ...
    ordinance_2020/
        index.html
        ordinance_01.html
        ordinance_02.html
        ...
    ...
    ordinance_2021/ -> redirects up to ordinance/

Code Block
ordinance/
index.html
ordinance_01.html
ordinance_02.html
...
ordinance_2019/
index.html
ordinance_01.html
ordinance_02.html
...
ordinance_2020/
index.html
ordinance_01.html
ordinance_02.html
...
...
ordinance_2021/ -> redirects up to ordinance/

Since 2021 is the current version, I want references to ordinance/ordinance_2021/ to redirect to ordinance/. I’m using an S3 conditional redirect rule:

Code Block [
    {
        "Condition": {
            "KeyPrefixEquals": "ordinance/ordinance_2021/"
        },
        "Redirect": {
            "ReplaceKeyPrefixWith": "ordinance/"
        }
    }
]

Code Block
[
{
"Condition": {
"KeyPrefixEquals": "ordinance/ordinance_2021/"
},
"Redirect": {
"ReplaceKeyPrefixWith": "ordinance/"
}
}
]

(Next year I’ll remove the redirect rule, create the ordinance_2021 subdirectory, copy this year’s version into it, and create a redirect rule for ordinance_2022.)

This sort of works.

I create a new browser window (Safari 14 on macOS Mojave), and type the link <wiltonzba.org/ordinance/ordinance_2021/index.html> into the address bar. The page loads properly and the browser address field shows “https://wiltonzba.org/ordinance/index.html”.
The page has a link with the text 2021 and the HREF ordinance_2021/index.html. If I click on it, I get exactly the same result.
Now if I click on the 2021 link, the (same) page loads properly, but the browser address field shows “Not Secure — http://wiltonzba.org/ordinance/index.html”.
Now if I click on the 2021 link, the browser address field shows “https://wiltonzba.org/ordinance/ordinance_2021/index.html”. The page HTML loads, but the associated CSS and images don’t load, because they are referenced with relative “up one level” URLs.

Is this a Safari bug? (As I noted above, this works in Chrome.)