4

In my company we are moving from http to https for as many sites as we can. In the end we redirect from http to https with a "301 Moved Permanently" (and set the HSTS header).

Now following question came up: What happens if we send a HTML newsletter with references to images via http (e.g. http://example.com/image.jpg) after we set up the redirect?

Do "common mail clients" like Thunderbird, Apple Mail, Outlook (2010, 2013, 2016) etc. understand the 301 redirect and load the images via https (the redirect for http://example.com/image.jpg goes to https://example.com/image.jpg)?

If not: What do they do instead?

migrated from security.stackexchange.com Dec 15 '16 at 7:53

This question came from our site for information security professionals.

  • 1
    Many (most?) common mail clients do not display external images at all by default which makes the question if redirect or not futile is most cases. And if you include the image instead directly into the mail so that it gets displayed from the client then you don't need to care about redirects at all. – Steffen Ullrich Dec 14 '16 at 10:46
  • 2
    You're right about the default. But then the question is: What happens if the user hits the button to load the images anyway? – HorstKevin Dec 14 '16 at 11:02
  • HSTS header is NOT going to work for old browser versions as well. HTTP rediect rule on the server can fix the issue for the time being. Or you need a different resource delivery site (which is ideal) cloud cdn is ideal – linodh Dec 14 '16 at 23:12
2

Yes. I just sent an email containing <img src="http://www.example.com/img/logo.png" alt="not displayed"/>. The example server is in my control in redirects to the same URL with https.

My findings:

  • GMail on 24 Oct 2017: It displays the image, but replaces it's location to something like https://ci3.googleusercontent.com/proxy/2ks...5hk=s0-d-e1-ft#http://www.example.com/img/logo.png. I guess that all browsers follow redirects and therefore all webmail interfaces should be fine.
  • Thunderbird 52.4.0: It doesn't load remote content by default, but after allowing it, the image gets displayed correctly.
  • Evolution 3.18.5.2: Same as Thunderbird. Once you load images via Ctrl+I, it's displayed.
  • Outlook (unknown version): A colleague confirmed that it's displaying on their Windows machine.
  • Mail on macOS (10.3): Another colleague confirmed that it's displaying when they re-open the email. It might just be that the image took a few seconds to load, not sure.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.