Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad?
I would like to immediately redirect to a different site upon receiving the https request. Will the browser allow that?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If I understand you correctly, you want to send a 302 response before the handshake is finished. A browser won't allow this for security reasons. Identifying the server by its server certificate is a crucial part of the SSL handshake - before this is completed, the browser cannot be sure that he is talking to the correct server.
That's why the answer is "no". The handshake must be finished before the browser will accept any content coming from the server. Otherwise it would be severely broken.
In case I misunderstood you and you want to send the 302 immediately after the handshake is finished, I see no problem here. The server can answer the request with any Response Code - if it happens to be 302, that's perfectly fine.
No, the the basic flow doesn't match what you're trying to do. Here's the order in which things happen:
verify certificate hostname against URL hostname
Request (including URL, hostname, POST data, cookies, etc.)
The protocol is simple but rigid. You can't change the order of these things, nor can you leave out steps. So unless what you're trying to do follows this pattern, it isn't going to work.
Short answer, No:
Allowing the redirect before the resolve will defeat the purpose of having a certificate. The certificate needs the be resolved first so it knows that you are on a trusted connection.
This is a chain reaction so if the first thing is untrusted people can just redirect you anywhere