How would a client's web-browser know if a websites is HTTPS only?
Here is the scenario, a client tries to access facebook.com by typing facebook.com in the address bar, the browser automatically goes to the non secure version http://facebook.com but Facebook doesn't allow it, it sends a redirect to the secure version of the website https://facebook.com.
This scenario seems vulnerable to me, an attacker (man in the middle) could intercept the traffic while the connection still was in HTTP and make the server never send a redirect to HTTPS and thus breaking the secure connection.
I'm pretty sure people already thought of this and fixed the problem but how?
Having a list of websites which are HTTPS only that comes with the web-browser doesn't seem to be effective.
Maybe the first time the client connects to the website, it receive a message that says to access the website via HTTPS only for a specific amount of time?