Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://.
I use python requests for this purpose, which simulate a client behavior. It performs the redirection and show me the final URL after redirection, if any.
Example: when I input http://facebook.com the get requets end up at https://facebook.com.
Does this mean the website DOES NOT accept http:// requests?
No this does not mean it doesn't accept http requests.
What's happening is that your browser (or python) is requesting the website on http (port 80) and it was redirected to https (port 443).
Redirection means that the server responded with http response of status code 301 or 302. You can view this by viewing the response.history within your response from python requests.
Your browser then understood the redirecting, and requested again the same website , but over https (port 443). In order for this to work, the server had to expose http (port 80) just to serve redirection response.
Usually when we say STRICT https, we mean something different.
It means the server still does all the above as before, but additionally adds a strict-transport-security header in the response from the server. This lets the browser know that any future requests should be made over https (port 443) directly, rather than waiting for the redirect. The browser once seeing this, will cache the header value.
From then on, until the header expires, the browser will perform an 'internal redirect' -- i.e. it will not even send out a http request over the network, rather it will internally redirect the requests to https. You can see this via a 307 redirect in Google Chrome developer tools. Unfortunately I'm not sure if you can replicate this behavior via python requests.
In summary, it's best practice to always have a port 80 open on your website to redirect users to port 443, and then have HSTS to ensure all future visits from those users will come directly to https (instead of just http).
Not having http will usually result in user-error, as the default for browsers is to attempt a plain-text http connection to site unless https is explicitly specified. If your site doesn't have http open, most users will fail at connecting to your site.
Hope that helps.
Python requests almost certainly does not use an https preload list, so the server must be responding to the http request with a redirect.
Does the server "accept http:// requests"? That's a trick question. I could answer: yes, because if the server did not respond to http requests at all, then it would not receive your request and could not respond with a redirect. So it must be listening on port 80 and reading your http request in order to be able to respond with a redirect. But if you are asking whether the server performs the requested action when you request an action over http instead of https, then the answer is probably no. Web servers are usually configured to just return a redirect and the client will just retry the request at the given location.
You also tagged your question with Firefox. Browsers might have features enabled that store a list of websites that are known to work with https, and Facebook would be on there. Because of this, browsers might not connect over http at all, because they don't need the redirect: when you type http, they will just connect over https, without first contacting the server and getting a redirect.
