3

Is it possible to respond to an SSL Handshake request by sending back a http 302 redirect without making the browser mad?

I would like to immediately redirect to a different site upon receiving the https request. Will the browser allow that?

6

If I understand you correctly, you want to send a 302 response before the handshake is finished. A browser won't allow this for security reasons. Identifying the server by its server certificate is a crucial part of the SSL handshake - before this is completed, the browser cannot be sure that he is talking to the correct server.

That's why the answer is "no". The handshake must be finished before the browser will accept any content coming from the server. Otherwise it would be severely broken.

In case I misunderstood you and you want to send the 302 immediately after the handshake is finished, I see no problem here. The server can answer the request with any Response Code - if it happens to be 302, that's perfectly fine.

4

No, the the basic flow doesn't match what you're trying to do. Here's the order in which things happen:

  1. Connect

  2. SSL Handshake

    1. certificate exchange

    2. verify certificate hostname against URL hostname

    3. setup crypto

  3. Request (including URL, hostname, POST data, cookies, etc.)

  4. Response, e.g:

    • 200 w/ data
    • 30x with Location: header
    • 404 not found

The protocol is simple but rigid. You can't change the order of these things, nor can you leave out steps. So unless what you're trying to do follows this pattern, it isn't going to work.

2

Short answer, No:

Allowing the redirect before the resolve will defeat the purpose of having a certificate. The certificate needs the be resolved first so it knows that you are on a trusted connection.

This is a chain reaction so if the first thing is untrusted people can just redirect you anywhere

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.