When we enter an URL in a browser, it uses HTTP by default but if the server only support HTTPS, does the traffic redirect to https automatically without the user noticing?
Am I right?
If wrong, please correct me.
21
51
No, at the moment no major browsers would redirect to HTTPS automatically.
The website can set HSTS header to tell browsers that they should redirect to HTTPS automatically for future requests, or they can register themselves into HSTS preload list, and users can install browser plugins to always load HTTPS based on a white list or even to always try HTTPS first. All of these are opt-in, either the website or the user has to do something to make the browser do this. In its default configuration, without explicit action by the user or the web site, no major browsers would automatically use HTTPS.
-
8If you redirect HTTP to HTTPS, make sure to mark your cookies as secure so you don't leak them in the initial accesses through http. – spectras Jul 28 '17 at 7:38
-
6You should always mark cookies as secure unless they are explicitly intended to be presented over HTTP - "if you redirect" is not a consideration, there are other ways to exploit sensitive data in cookies which don't have the secure flag. – symcbean Jul 28 '17 at 11:06
-
5@MTCoster The answer is worded a bit ambiguously, but your interpretation is not the intended one; the "in the future" part means that the browser will only automatically redirect to HTTPS after it receives the HSTS header, presumably over plain HTTP. Read it as: "The website can set the HSTS header to tell browsers that they should redirect any future requests to HTTPS automatically, ..." – marcelm Jul 28 '17 at 11:33
-
2From Teo (not enough rep to comment): EFF has a browser extension for HTTPS as well. eff.org/https-everywhere – Serge Ballesta Jul 28 '17 at 12:47
-
1@LuccaFerri I'm assuming "preload" means using this - hstspreload.org - not loading the page previously. Using it makes 443 blocking useless: users will see a error, but never a unsafe page. It also stops users from skipping warnings. That's also better than HTTPS Everywhere because users don't need to download a extension to use it. It's easy to use and even IE 11 on a computer that never visited none of my websites before redirects those to HTTPS without opening any HTTP connections because of it. – Gustavo Rodrigues Sep 11 at 12:46
16
No.
You have to explicitly redirect the HTTP traffic to HTTPS which involves configuring your web server with a rule which returns HTTP 301 status code and a location header beginning with https://.
So for example in Nginx you would write something like:
server {
listen 80;
server_name my.domain.com;
return 301 https://$server_name$request_uri;
}
In addition you could add an Http Strict Transport Security (HSTS) header to the responses of requests which you receive on the HTTPS port. This will ensure that the browser sends all ensuing requests to the HTTPS port.
Again, in Nginx you would do this:
server {
listen 443 ssl;
server_name my.domain.com;
add_header Strict-Transport-Security "max-age=31536000";
}
-
1Note that the part of the question "traffic redirect to https automatically without the user noticing" is often true (despite the correct "no" answers here). It's just that the web server has to be configured to do the redirect. So there is an initial HTTP connection (if the server really only serves HTTPS then it just won't connect, unless the browser has a pre-loaded HSTS list which includes that domain). But such servers do redirect "without the user noticing", so people think it's automagic. – Adam Jul 28 '17 at 13:12
-
You shouldn't send the HSTS header on the initial HTTP connection, but instead on the first HTTPS connection, as it could potentially be tampered with otherwise. – someonewithpc Jul 28 '17 at 22:52
-
1@someonewithpc That's exactly what I've written. The HSTS header is sent when the connection is on port 443, not on port 80. – user90696 Jul 28 '17 at 22:57
-
-
2
Some website use HSTS(https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) which basically do what you're saying. If a user try to access some random http://example.com, HSTS will transform the request into https://example.com, however the website need to have a valid certificate in order to function properly.
-
@Octopus This is indeed one of the functions of HSTS. If a site is in a HSTS preload list, or you've visited it before and observed an HSTS header that has not yet expired, the browser will automatically issue HTTPS requests, even if HTTP is specified. – Xander Jul 28 '17 at 18:22
-
1Browsers must and do ignore HSTS headers received over plain HTTP. So you cannot rely on that header alone to get HTTPS used automatically. – n0rd Jul 28 '17 at 20:14
protected by Community♦ Oct 25 '17 at 13:48
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?
online.sberbank.ruwill not load via HTTP, but it works fine with HTTPS. The user will surely notice if they just typed the domain into browser's address line — the browser will do nothing to try HTTPS version, so the page won't load. – Ruslan Jul 29 '17 at 5:40