When we enter an URL in a browser, it uses HTTP by default but if the server only support HTTPS, does the traffic redirect to https automatically without the user noticing?
Am I right?
If wrong, please correct me.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityWhen we enter an URL in a browser, it uses HTTP by default but if the server only support HTTPS, does the traffic redirect to https automatically without the user noticing?
Am I right?
If wrong, please correct me.
No, at the moment no major browsers would redirect to HTTPS automatically.
The website can set HSTS header to tell browsers that they should redirect to HTTPS automatically for future requests, or they can register themselves into HSTS preload list, and users can install browser plugins to always load HTTPS based on a white list or even to always try HTTPS first. All of these are opt-in, either the website or the user has to do something to make the browser do this. In its default configuration, without explicit action by the user or the web site, no major browsers would automatically use HTTPS.
No.
You have to explicitly redirect the HTTP traffic to HTTPS which involves configuring your web server with a rule which returns HTTP 301
status code and a location header beginning with https://
.
So for example in Nginx you would write something like:
server {
listen 80;
server_name my.domain.com;
return 301 https://$server_name$request_uri;
}
In addition you could add an Http Strict Transport Security (HSTS) header to the responses of requests which you receive on the HTTPS port. This will ensure that the browser sends all ensuing requests to the HTTPS port.
Again, in Nginx you would do this:
server {
listen 443 ssl;
server_name my.domain.com;
add_header Strict-Transport-Security "max-age=31536000";
}
Some website use HSTS which basically do what you're saying. If a user try to access some random http://example.com
, HSTS will transform the request into https://example.com
. However, the website needs to have a valid certificate in order to function properly.
"if the server only support HTTPS", then all traffic should be routed to https by the server.
If host server supports both, then preference to https may be given via several methods eg. DNS redirection (by Domain host), server directives (301/302 via .htaccess files) of web host, application redirection (server side scripting eg. perl/php script), or client redirection (javascript/meta refresh). In these cases, if someone was to access pages via http, they will receive pages via https (automatically).
An example of script redirection in a php file (where you don't have control of the host server):
<?php
if ($_SERVER["SERVER_PORT"] == 80 && $_SERVER["REQUEST_SCHEME"] == "http") {
header('Location: https://your.domain.url', TRUE, 301);
}
?>
<html>
<head>
...
</html>
If neither of the above have been deployed, access to page via unsupported protocol will give 500, 501, 403, or 404 errors or just not load, showing "ERR_CONNECTION_REFUSED" in browsers. In these cases, users may themselves type in https in web browsers to ensure data delivery via ssl/tls, or install helpers like browser plugins (which replace url with https://url)
CNAME
doesn't perform any redirections, and certainly not protocol upgrades like this! It's merely an alias pointing to the canonical name. From the Namecheap link you provided: "CNAME record is actually not a redirect type record but often mistakenly used as such."
Aug 21, 2020 at 16:42
online.sberbank.ru
will not load via HTTP, but it works fine with HTTPS. The user will surely notice if they just typed the domain into browser's address line — the browser will do nothing to try HTTPS version, so the page won't load.