How is HTTP converted to HTTPS when no HSTS is present?

Question

Suppose you have a website http://example.com

Now, you also have an SSL certificate, which means users can access the site securely using https://example.com

But if I just write http://example.com in the address bar, how can the client get to convert it to https://example.com when it didn't use the HSTS response header (which forces the client to use https).

In other words, if I go to port 80, how am I redirected to port 443?

Answer 1

The site is manually redirecting you to the HTTPS version of the site, typically using the HTTP 301 redirect status code. This is not as secure as HSTS because it is vulnerable to a MITM attack, but it does cause you to transparently switch to the encrypted version of the site. This behavior must be configured in the server to work. The server can either be made to automatically perform the 301 redirect on all pages, or only for certain pages such as those with password input fields.

The client first sends a request to the non-encrypted version of the site:

GET /index.html HTTP/1.1
Host: www.example.com

The site then responds with a redirect:

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/index.html

This instructs your browser to send another GET request, this time to port 443 with TLS.

Note that, even when HSTS is used, this is still necessary for the first connection. HSTS headers are only allowed to be set over the HTTPS protocol, so a redirect is usually used to tell the browser to use the encrypted protocol the first time. Only after that will the browser remember that it should rewrite all requests to the encrypted version of the site without being told first.