1

Suppose you have a website http://example.com

Now, you also have an SSL certificate, which means users can access the site securely using https://example.com

But if I just write http://example.com in the address bar, how can the client get to convert it to https://example.com when it didn't use the HSTS response header (which forces the client to use https).

In other words, if I go to port 80, how am I redirected to port 443?

Improve this question
1
  • 1
    Well, that's done through a 30x redirect. Is that what you're asking?
    – Arminius
    Jul 5, 2018 at 5:07

1 Answer 1

Reset to default
6

The site is manually redirecting you to the HTTPS version of the site, typically using the HTTP 301 redirect status code. This is not as secure as HSTS because it is vulnerable to a MITM attack, but it does cause you to transparently switch to the encrypted version of the site. This behavior must be configured in the server to work. The server can either be made to automatically perform the 301 redirect on all pages, or only for certain pages such as those with password input fields.

The client first sends a request to the non-encrypted version of the site:

GET /index.html HTTP/1.1
Host: www.example.com

The site then responds with a redirect:

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/index.html

This instructs your browser to send another GET request, this time to port 443 with TLS.

Note that, even when HSTS is used, this is still necessary for the first connection. HSTS headers are only allowed to be set over the HTTPS protocol, so a redirect is usually used to tell the browser to use the encrypted protocol the first time. Only after that will the browser remember that it should rewrite all requests to the encrypted version of the site without being told first.

Improve this answer
6
  • but Is the site redirecting because it uses SSL Certificate? Or we place 301 redirections on every page of Site?
    – Utkarsh Agrawal
    Jul 5, 2018 at 5:11
  • 1
    @UtkarshAgrawal The website can be configured to do this automatically for every page, or only for certain pages. Of course, it only works if you have a certificate. Otherwise the redirect will break.
    – forest
    Jul 5, 2018 at 5:11
  • Thanks, it helps, but one thing more, i.e. How it will do automatically, I mean I want to get a clear picture about.
    – Utkarsh Agrawal
    Jul 5, 2018 at 5:14
  • @UtkarshAgrawal Are you asking what the actual configuration file looks like?
    – forest
    Jul 5, 2018 at 5:14
  • 1
    I've edited the answer to link to an example for htaccess.
    – forest
    Jul 5, 2018 at 5:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .