I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously.
Lets say a user requests the route user@pass:<url>/ping
over HTTP. They can either be:
- Redirected to HTTPS, not necessarily realizing their HTTP requests always get redirected, which means they can continue to do so.
- Blocked. All attempts to HTTP are served with a "forbidden" response of some sort. They will realize, as they can't access the endpoint, but I guess the data sent is still revealed.
If a user sends a request with Basic Authentication header over HTTP, and it gets redirected to HTTPS, either as a rewrite or with HSTS in place, hasn't the information still been revealed?
If so, I'd imagine blocking HTTP would be a more effective way of telling the user to stop requesting the HTTP route. The redirect may never cause them to actually stop using HTTP for the initial request.
I have a feeling I might misunderstand some feature of the redirect that still preserves the security of the data being sent...?