This question already has an answer here:
- How does HSTS stop MitM attacks? 2 answers
I often use a guest WiFi which does the usual intercept; attempt to navigate to any HTTP website and it redirects you to the "Agree to our ToS" page, after which it will permit any traffic from your MAC address in the normal way.
Usually I just pick any web page and hit reload, but this WiFi does not like
https://. The query must be
OK, so I go into the address bar and delete the "s" from HTTPS, and hit "go". E.G.
And then my local browser puts the "s" back. It makes the query on port 443, which the guest WiFi blocks. It has to be the local browser doing this, since it has literally no Internet. I can vouch for this occurring on Amazon's Silk browser, Firefox on Android, and I believe Safari/iOS.
Is this a policy of web browser clients to force to HTTPS anytime the browser knows the site supports HTTPS? What threat does that defend against?