How does webserver informs the browsers of the https capability?
if we type in microsoft.com (which is a http request by default) firefox fetches/the server serves the following page https : // www.microsoft.com/en-in/ .The original request is in http.
we see a Http get request for http : //microsoft.com/ with Upgrade-Insecure-Requests: 1 flag (the clients willingness to go to a secured connection)
next we see a http 301 moved permanently. this packet contains the location field as http: // www.microsoft.com /
next we see the client starting out a TLS handshake to start out the https session and eventually get the https page
where can we see the server informing the client of the https capability or redirecting for https port 443?
can we suppress the Upgrade-Insecure-Requests flag so that we get a http response?(assuming the server doesnot automatically redirect to https)
attached is a wirehark capture. filter using the following
(http contains microsoft) or (ssl contains microsoft)