1

I have sent a HTTP GET request to google.com and I get a 302 status. Now the location : url in http header is an http:// address, instead of https. When the browser visits this address I get back a 302 redirect again but with an https address in the location field of http header. The browser then visits this address and https connection is established. Also the IP of the first server which sent me a 302 redirect is different from the second 302 redirect sender. Finally the server with which I establish an https connection has a different ip.

My question is why do I not get a https redirect in the first 302 reply?

Also, I am using a program which sends an HTML GET request to a server and gets back the response. How can I simulate this chain of 302 redirects to reach the final server which returns an https page?

The program takes as input ./execfile_name host_name page.

Every time I supply the google.com hostname it connects to the same server (same IP). How can I get it to connect to the next server in the chain leading to the final one?

closed as off-topic by schroeder, Stephane, Graham Hill, Xander, Mark Jul 8 '15 at 2:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Stephane, Graham Hill, Xander, Mark
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Have you bookmarked the final URL? That may work better. – Neil Smithline Jun 22 '15 at 16:38
  • would you provide the request and response headers for both examples? – user2320464 Jun 22 '15 at 17:50
-1

why do I not get a https redirect in the first 302 reply

Bad programming on the part of of whoever designed the system - bobbing out of https makes it trivial to carry out a MITM attack on the connection.

How can I get it to connect to the next server in the chain leading to the final one

Use a better program. HTTP is deceptively complex. You can point a simple socket adapter at port 80 on a webserver, type in 'GET / HTTP/1.0\r\n\r\n' and get a sensible response nine times out of ten - but HTTP allows for more compex stuff like chunked encoding and redirects before you even start to consider session management and intrusion prevention.

Personally I use wget or curl from the command line (both of which can automatically follow redirects) or libcurl in scripts/programs.

  • Why? And what would you use to script/record an HTTP interaction? – symcbean Jun 23 '15 at 8:12
  • My bad @symcbean. I didn't realize that the question was about both browser and script behavior. – Neil Smithline Jun 23 '15 at 8:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.