Should it be best practice to force 301 redirect in addition to Strict-Transport-Security header?

Question

I've understood guidance to use Strict-Transport-Security header for connections over HTTP.

Now on the face of it, it seems like 301 redirecting HTTP traffic to come over HTTPS is intended to achieve the same effect. However, as we know from questions like Is an HTTP 301 redirect to HTTPS, insecure?, 301 redirects don't actually create perfect security.

So yes, 301 redirect doesn't really prevent MITM attack, but it does seem to me like it can help prevent eavesdropping attacks. So assuming we care about information disclosure of the server response, is there any reason it wouldn't be best practice to always 301 redirect incoming HTTP traffic in addition to using the Strict-Transport-Security header?

Answer 1

Yes, absolutely. If you implement HTTP Strict Transport Security (HSTS) you should also create an explicit redirect from HTTP to HTTPS. This will also benefit clients that didn't implement the HSTS standard.

If you want to submit your website to the HSTS Preload List this behavior is even mandatory:

In order to be accepted to the HSTS preload list through this form, your site must satisfy the following set of requirements:

1. Serve a valid certificate.
2. Redirect from HTTP to HTTPS on the same host.
3. Serve all subdomains over HTTPS. (...)
4. Serve an HSTS header on the base domain for HTTPS requests: (...)

Note that the 301 redirect achieves not the same as HSTS. Both techniques redirect a user from HTTP to HTTPS but with HSTS the browser will remember to use HTTPS on that site until a specified timeout is reached. HSTS is trust-on-first-use, so a user is only vulnerable the very first time they ever enter mybank.com into the address bar. After that, an attacker cannot trick you into visiting the HTTP version again.

Related question: What's the difference between using HSTS and doing a 301 redirection?