Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

Question

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under the impression that anything after the hostname on an HTTPS site goes over TLS.

No.     Time           Source                Destination           Protocol Length Info
      7 4.011566600    localhost             1.1.1.1               DNS      81     Standard query 0xbbe4 AAAA reddit.com OPT
      8 4.011637536    localhost             1.1.1.1               DNS      81     Standard query 0xb53e A reddit.com OPT
      9 4.040719948    1.1.1.1               localhost             DNS      162    Standard query response 0xbbe4 AAAA reddit.com SOA ns-557.awsdns-05.net OPT
     10 4.040720105    1.1.1.1               localhost             DNS      145    Standard query response 0xb53e A reddit.com A 151.101.65.140 A 151.101.1.140 A 151.101.193.140 A 151.101.129.140 OPT
     11 4.041287804    localhost             151.101.65.140        TCP      74     57950 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3418794681 TSecr=0 WS=128
     12 4.070029182    151.101.65.140        localhost             TCP      74     80 → 57950 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1360 SACK_PERM=1 TSval=1818974879 TSecr=3418794681 WS=512
     13 4.070086686    localhost             151.101.65.140        TCP      66     57950 → 80 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=3418794709 TSecr=1818974879
     14 4.070356325    localhost             151.101.65.140        HTTP     1132   GET /r/privacy HTTP/1.1 
Frame 14: 1132 bytes on wire (9056 bits), 1132 bytes captured (9056 bits) on interface wlp2s0, id 0
Ethernet II, Src: RivetNet_8c:64:69 (9c:b6:d0:8c:64:69), Dst: ARRISGro_46:93:40 (10:93:97:46:93:40)
Internet Protocol Version 4, Src: localhost    , Dst: 151.101.65.140
Transmission Control Protocol, Src Port: 57950, Dst Port: 80, Seq: 1, Ack: 1, Len: 1066
    Source Port: 57950
    Destination Port: 80
    [Stream index: 0]
    [TCP Segment Len: 1066]
    Sequence Number: 1    (relative sequence number)
    Sequence Number (raw): 742023486
    [Next Sequence Number: 1067    (relative sequence number)]
    Acknowledgment Number: 1    (relative ack number)
    Acknowledgment number (raw): 3930292880
    1000 .... = Header Length: 32 bytes (8)
    Flags: 0x018 (PSH, ACK)
    Window: 502
    [Calculated window size: 64256]
    [Window size scaling factor: 128]
    Checksum: 0x9fd1 [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
    [SEQ/ACK analysis]
    [Timestamps]
    TCP payload (1066 bytes)
Hypertext Transfer Protocol
    GET /r/privacy HTTP/1.1\r\n
        [Expert Info (Chat/Sequence): GET /r/privacy HTTP/1.1\r\n]
            [GET /r/privacy HTTP/1.1\r\n]
            [Severity level: Chat]
            [Group: Sequence]
        Request Method: GET
        Request URI: /r/privacy
        Request Version: HTTP/1.1
    Host: reddit.com\r\n
    Connection: keep-alive\r\n
    DNT: 1\r\n
    Upgrade-Insecure-Requests: 1\r\n
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\r\n
    Accept-Encoding: gzip, deflate\r\n
    Accept-Language: en-US,en;q=0.9\r\n
    [Full request URI: http://reddit.com/r/privacy]
    [HTTP request 1/1]
    [Response in frame: 16]
     15 4.102732401    151.101.65.140        localhost             TCP      66     80 → 57950 [ACK] Seq=1 Ack=1067 Win=137216 Len=0 TSval=1818974912 TSecr=3418794710
     16 4.102732942    151.101.65.140        localhost             HTTP     530    HTTP/1.1 301 Moved Permanently 
     17 4.102833976    localhost             151.101.65.140        TCP      66     57950 → 80 [ACK] Seq=1067 Ack=465 Win=64128 Len=0 TSval=3418794742 TSecr=1818974912
     18 4.103379442    localhost             151.101.65.140        TCP      66     57950 → 80 [FIN, ACK] Seq=1067 Ack=465 Win=64128 Len=0 TSval=3418794743 TSecr=1818974912
     19 4.104849695    151.101.65.140        localhost             TCP      66     80 → 57950 [FIN, ACK] Seq=465 Ack=1067 Win=137216 Len=0 TSval=1818974914 TSecr=3418794710     20 4.104940318    192.168.1.231         151.101.65.140        TCP      66     57950 → 80 [ACK] Seq=1068 Ack=466 Win=64128 Len=0 TSval=3418794744 TSecr=1818974914
     20 4.104940318    192.168.1.231         151.101.65.140        TCP      66     57950 → 80 [ACK] Seq=1068 Ack=466 Win=64128 Len=0 TSval=3418794744 TSecr=1818974914
     21 4.117660987    192.168.1.231         151.101.1.140         TLSv1.2  600    Application Data

Can anyone outside my network can see this and is there a way to prevent the leak of the full URL and only use HTTPS?

Answer 1

Unless a site is on the HSTS preload list, browsers usually default to http instead of https when no protocol is provided by the user. So when a user types reddit.com in the url bar, the browser navigates to http://reddit.com. Reddit will then tell the browser to redirect to https://reddit.com. This is done because some sites do not support https and the browser has no way of knowing before hand whether any particular site supports https or not. Of course, this means the initial request is not encrypted and visible to anybody sniffing your traffic.

However, given the increasing prevalence of TLS, this behavior is changing. Starting from v90, chrome defaults to https and will fall back to http only if the https connection is unsuccessful.