0

Before the invention of HSTS security policy, if a user didn't specify the protocol in the URL, were all the initial requests sent over HTTP by default for every website?

Improve this question
0

1 Answer 1

Reset to default
0

FIrst request is made over HTTP then the site redirects you to the HTTPS website.

Check out this post

It says it in an example of how sites used to work:

More specifically, these are the steps for logging into the bank’s site:

  1. You type “www.mybank.com” into the address bar and hit enter.
  2. The browser assumes “www.mybank.com” should be requested over HTTP by default, so the initial request is unencrypted.
  3. The server at “http://www.mybank.com” responds with an HTTP redirect to “https://www.mybank.com”
  4. The secure connection is established, and a login page is served via HTTPS.
  5. You enter your password and do your banking.
Improve this answer
2
  • Is this only when HSTS is not implemented on websites?
    – user241274
    Commented Aug 16, 2020 at 19:16
  • This what they used to do before HSTS, if the website doesn't redirect you to HTTPS then you will remain on the HTTP website. I think HSTS has to be initiated by the browser and implemented in the browser as well
    – Khalid
    Commented Aug 16, 2020 at 19:55

Not the answer you're looking for? Browse other questions tagged .