2

A lot of sites now default to https. Where beforehand i would have had to asked for https specifically (ie: typing out https://www.google.com) now even if I type out just www.google.com or even explicitly call http://www.google.com it will automatically go to the https version. How is this setup? is this part of the DNS records or is this a server side redirect?

Improve this question
2
  • 4
    This is a server side redirect; the HTTP site just redirects to the HTTPS version. If you're wondering it does present a potential vulnerability in that an attacker could block this redirect from happening, and the user may not notice that they weren't redirected to HTTPS. This is the basis for how programs like SSLstrip work.
    – user54791
    Sep 29, 2014 at 22:29
  • Which browser are you using?
    – curiousguy
    Sep 30, 2014 at 3:04

2 Answers 2

Reset to default
6

For any given site this could be a server redirect. Alternatively, the site in question may be using HSTS - a special header that tells tour browser to only connect to the site over HTTPS.

In addition some browser (Chrome and Firefox at least) include preloaded lists of sites supporting HSTS, so your browser will never connect to them over HTTP (Without the preloaded list, your browser will try an HTTP connection before it receives the sites HSTS header for the first time - unless you manually typed https).

Improve this answer
1

Any site that automatically forwards you to https is using a server side redirect. There are extensions for most browsers to look for https sites and connect to them if available, but browsers don't "know".

Improve this answer
1
  • 1
    What about HSTS (assuming the site in question implements it)? Granted this requires visiting the site at least once.
    – lzam
    Sep 30, 2014 at 3:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .