7

My Chrome (40.0.2214.115m) jumps to non-existent https :

I type in

http://johnwhitech.homeip.net:8080/

And Chrome redirect to

http s ://johnwhitech.homeip.net:8080/

which does not exist. I do not have HTTPS everywhere.

In network analyzer, I see that my server answered a 307 redirect which is not true (apache is configured correctly and does not gives this answer, other browsers don't redirect, HTTP packets loop perfectly normal).

I tried to log the request with fiddler, here is it :

CONNECT johnwhitech.homeip.net:8080 HTTP/1.1

Host: johnwhitech.homeip.net:8080

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)

Chrome/40.0.2214.115 Safari/537.36

A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.

...

Other strange thing : in the HOST column of fiddler, if I try with firefox, I see my server name. With chrome, I only see "Tunnel to..." even for the very first request. The protocol is indeed HTTP (look at the beginning of the packet), but why on hearth my chromes sends a SSL "ClientHello" along with it ?

Is it a normal behavior ?

The only thing I see that might be related to SSL is that I installed a self-signed certificate, first via chrome settings, then system-wide. This certificate works well, but maybe since the domain name matches a certificate in the list, chromes tries SSL ?

Thanks folks !


EDIT3 : This behavior also happens without internet connectivity (cache cleared), so definitely not on the server-side


EDIT4 : What I see in the "NETWORK" tab of Chrome Dev Tools. The first entry is normal, the second entry is via HTTP which gets immediably redirected to HTTPS. This happens with no network connection, in particular the server is not sending HSTS.

https://i.stack.imgur.com/xfoxA.png

3
  • What software do you use on server? Mar 3, 2015 at 15:48
  • Chrome does CONNECT because that’s how HTTPS works over (non-transparent) proxies. Incidentally, Fiddler is a proxy. You should instead focus on whether Apache does or does not send a redirect. Use Wireshark or tcpdump to analyze traffic on your server machine.
    – Daniel B
    Mar 3, 2015 at 15:53
  • Thanks for the info about CONNECT. Edited, especially : also happens without internet connectivity.
    – lbarman
    Mar 3, 2015 at 16:01

1 Answer 1

11

Chrome clearly states the reason: HSTS. HSTS, once received, sticks. This is an essential part of the concept. This means that if Chrome received a HSTS header from your server, even if only once, it will stick until it expires.

To check Chrome’s HSTS cache, go to chrome://net-internals/#hsts. From there, you can query the cache. Unless it reports “Not Found”, Chrome has a cached HSTS header from your page. To remove it, use the tool provided on the same page.

2
  • Great ! it was this. Did not know that HSTS sticked, and I thought the "no caching" option of dev-tools was performing a clean state. Great input. For the record, I did not setup my Apache server to send HSTS, so it seems sufficient that at one point, an address is accessible via HTTPS for chrome to remember it and "force SSL" via HSTS later on.
    – lbarman
    Mar 3, 2015 at 23:56
  • chrome://net-internals/#hsts is disabled in newer versions of crhome
    – tutuca
    Oct 10, 2019 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .