22

When we enter an URL in a browser, it uses HTTP by default but if the server only support HTTPS, does the traffic redirect to https automatically without the user noticing?

Am I right?

If wrong, please correct me.

| improve this question | | | | |
  • 2
    Actual example: online.sberbank.ru will not load via HTTP, but it works fine with HTTPS. The user will surely notice if they just typed the domain into browser's address line — the browser will do nothing to try HTTPS version, so the page won't load. – Ruslan Jul 29 '17 at 5:40
  • 3
    Do you, by chance, have HTTPS everywhere plugin installed and forgot about it? That one does automatically replace http with https. – Jan Hudec Jul 29 '17 at 18:47
  • @kst - Wondering if a browser can be forced to do so via an Extension or Script? – Alex S Jul 29 '17 at 22:39
  • The proper way to do this is have a non-SSL http server send a redirect to the https URL. Same way you can send example.com to www.example.comm etc – ivanivan Jul 30 '17 at 1:40
  • Related: security.stackexchange.com/questions/124633/… – Jedi Jul 30 '17 at 3:33
53

No, at the moment no major browsers would redirect to HTTPS automatically.

The website can set HSTS header to tell browsers that they should redirect to HTTPS automatically for future requests, or they can register themselves into HSTS preload list, and users can install browser plugins to always load HTTPS based on a white list or even to always try HTTPS first. All of these are opt-in, either the website or the user has to do something to make the browser do this. In its default configuration, without explicit action by the user or the web site, no major browsers would automatically use HTTPS.

| improve this answer | | | | |
  • 8
    If you redirect HTTP to HTTPS, make sure to mark your cookies as secure so you don't leak them in the initial accesses through http. – spectras Jul 28 '17 at 7:38
  • 6
    You should always mark cookies as secure unless they are explicitly intended to be presented over HTTP - "if you redirect" is not a consideration, there are other ways to exploit sensitive data in cookies which don't have the secure flag. – symcbean Jul 28 '17 at 11:06
  • 5
    @MTCoster The answer is worded a bit ambiguously, but your interpretation is not the intended one; the "in the future" part means that the browser will only automatically redirect to HTTPS after it receives the HSTS header, presumably over plain HTTP. Read it as: "The website can set the HSTS header to tell browsers that they should redirect any future requests to HTTPS automatically, ..." – marcelm Jul 28 '17 at 11:33
  • 2
    From Teo (not enough rep to comment): EFF has a browser extension for HTTPS as well. eff.org/https-everywhere – Serge Ballesta Jul 28 '17 at 12:47
  • 1
    @LuccaFerri I'm assuming "preload" means using this - hstspreload.org - not loading the page previously. Using it makes 443 blocking useless: users will see a error, but never a unsafe page. It also stops users from skipping warnings. That's also better than HTTPS Everywhere because users don't need to download a extension to use it. It's easy to use and even IE 11 on a computer that never visited none of my websites before redirects those to HTTPS without opening any HTTP connections because of it. – Gustavo Rodrigues Sep 11 '19 at 12:46
17

No.

You have to explicitly redirect the HTTP traffic to HTTPS which involves configuring your web server with a rule which returns HTTP 301 status code and a location header beginning with https://.

So for example in Nginx you would write something like:

server {
       listen         80;
       server_name    my.domain.com;
       return         301 https://$server_name$request_uri;
}

In addition you could add an Http Strict Transport Security (HSTS) header to the responses of requests which you receive on the HTTPS port. This will ensure that the browser sends all ensuing requests to the HTTPS port.

Again, in Nginx you would do this:

server {
       listen         443 ssl;
       server_name    my.domain.com;
       add_header Strict-Transport-Security "max-age=31536000"; 
}
| improve this answer | | | | |
  • 1
    Note that the part of the question "traffic redirect to https automatically without the user noticing" is often true (despite the correct "no" answers here). It's just that the web server has to be configured to do the redirect. So there is an initial HTTP connection (if the server really only serves HTTPS then it just won't connect, unless the browser has a pre-loaded HSTS list which includes that domain). But such servers do redirect "without the user noticing", so people think it's automagic. – Adam Jul 28 '17 at 13:12
  • You shouldn't send the HSTS header on the initial HTTP connection, but instead on the first HTTPS connection, as it could potentially be tampered with otherwise. – someonewithpc Jul 28 '17 at 22:52
  • 1
    @someonewithpc That's exactly what I've written. The HSTS header is sent when the connection is on port 443, not on port 80. – user90696 Jul 28 '17 at 22:57
  • @Rahul Oh, right. It wasn't very clear – someonewithpc Jul 28 '17 at 22:59
  • Be mindful of SSL Strip though. – Lucca Ferri Sep 9 '19 at 8:13
2

Some website use HSTS(https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) which basically do what you're saying. If a user try to access some random http://example.com, HSTS will transform the request into https://example.com, however the website need to have a valid certificate in order to function properly.

| improve this answer | | | | |
  • @Octopus This is indeed one of the functions of HSTS. If a site is in a HSTS preload list, or you've visited it before and observed an HSTS header that has not yet expired, the browser will automatically issue HTTPS requests, even if HTTP is specified. – Xander Jul 28 '17 at 18:22
  • 1
    Browsers must and do ignore HSTS headers received over plain HTTP. So you cannot rely on that header alone to get HTTPS used automatically. – n0rd Jul 28 '17 at 20:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.