Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Type xkcd.com in location bar, hit return -> https://xkcd.com.

But if I type http://xkcd.com instead, it does not change to HTTPS.

I've checked both URLs, and they're not using HSTS headers. I'm not using HTTPS Everywhere. (And in either case, I wouldn't have expected it to be so easily bypassed). I don't have the HTTPS site bookmarked - in fact I have the HTTP url bookmarked.

Iceweasel (Firefox-ish) 16.0.2. (I guess my updates are probably slightly screwed up).

How does this work? Do other browsers do it as well?

share|improve this question
    
I'm thinking it has to do with witch one you went to first in your history. Have you tried it from a clean profile? –  heavyd Feb 19 '13 at 18:00

2 Answers 2

up vote 4 down vote accepted

According to After updating to 14.0.1 Firefox will force https on websites. How do I fix?, this is due to auto-completion:

it is because of the autocomplete. Is there any way to fix this without disabling this feature though?

So far, I haven't read about any ways to change how the autofill URL is selected from history.

If you turn off urlbar.autofill, then Firefox 14 will behave like Firefox 13: (1) the drop-down of list of matches from your bookmarks and history will appear below the address bar, and (2) if you don't choose a match from the list but instead press Enter, Firefox will load http:// + what you typed (or if you typed separate words, it will run a search).

If you've previously visited the HTTPS version of the page, you will see this when typing "xkcd" into the address bar:

enter image description here

When hitting Enter at this stage, you will land on https://xkcd.com, just like you're experiencing.

You can also highlight the https://xkcd.com in the dropdown and hit Del. The URL will then be removed and will land on the HTTP version the next time.

share|improve this answer
2  
Deleting the entry in the dropdown doesn't change it for me. Clearing the browser history does though. –  sourcejedi Feb 19 '13 at 18:52

The autofill is recalling a previous usage of the https URL in your history. To avoid this behaviour for just that URL remove it from the history but if you want to avoid this going forward for all URLs set the Boolean pref browser.urlbar.autoFill to false on the about:config page.

http://kb.mozillazine.org/about:config

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.