Our web app home page redirects from HTTP to HTTPS. Our security consultant has told us this is a significant security weakness, that the redirect could be intercepted e.g. by SSLStrip. And therefore, we should remove the redirect, and disable HTTP entirely, requiring the user to manually type in https://...
Having studied the issue myself, it seems to me that the initial http response can be MITM faked by an attacker directly - no need for a redirect. So, removing the redirect achieves nothing.
I'm not sure though, if SSLStrip itself specifically can do this - maybe it needs to see the initial HTTP response first.
I understand that HSTS would prevent this problem, IF the device/browser in question has contacted our app once before. But for the initial contact, the HTTP request can be hijacked, regardless of what the app does - there is no protection, unless our web app were popular enough to be included in browser HSTS lists.
What did I miss? Is the redirect from HTTP to HTTPS significant?
I'm loathe to remove it as it will prevent many typical users from being able to connect to our site, and it doesn't seem to achieve anything.