So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)
This means, in theory, if you POST to say https://example.com then it can redirect to http://example.com and the POST request will be sent in plain-text. This is very unintuitive, but is it insecure? Is it possible to stage an attack using this assumption if you have control of the routing and/or DNS of the client? Could you somehow hi-jack say https://facebook.com to redirect to your plain-text server and get away with their login info?
Note: it will of course error out on certificate mismatches or other certificate errors, but it will blindly allow you to redirect a POST or GET from an HTTPS link to an HTTP link
Is this exploitable from the point of view of a captive portal?