664

I had something set up wacky in our DNS setup which is now resolved.

The remaining problem is that chrome has cached the incorrect setup.

Specifically, when using Chrome http://example.com is now redirecting to https://example.com (naked domain), which is not valid/supported. http://example.com SHOULD redirect to http://www.example.com and then force https://www.example.com.

But on a handful of browsers (including mine) this doesn't happen because of some funky Chrome caching. I tried going to “Privacy -> Clear Cache” but it had no effect.

Improve this question
4

12 Answers 12

Reset to default
971

In addition to cached redirects, HTTP Strict Transport Security (aka HSTS) may be at play. HSTS is a security feature that forces the browser to use HTTPS even when accessing an HTTP URL.

The browser will start using HSTS for a domain after receiving a Strict-Transport-Security header from the server. The browser also ships with a list of domains for which HSTS is enabled by default.

In Chrome, there is a way to delete your domain from HSTS after it was added by the server. Though, you can’t exclude domains that are baked in the browser (this includes popular websites and notably everything under the new .dev TLD)

  1. Go to chrome://net-internals/#hsts. Enter example.com under Delete domain security policies and press the Delete button.

  2. Now go to chrome://settings/clearBrowserData, tick the box Cached images and files and press click the button Clear data.

Improve this answer
25
  • 3
    This helped me as well!!! While developing internally and having the same problem of the redirect!
    – Marcello de Sales
    Commented Jul 12, 2015 at 3:11
  • 5
    Man, this had been bugging me for ages, finally got it, thanks! A potential gotcha of note: If the domain you're having trouble with is a subdomain you may need to delete the primary domain from the HSTS set if "include subdomains for STS is set to true". If you run a query on the parent domain you should see if that's set or not for the domain in question.
    – Pooch
    Commented Jan 6, 2016 at 17:40
  • 27
    This only worked for me after I also cleared my browser cache. In chrome: Settings > Show advanced settings… > Privacy > Clear browsing data... Source
    – nittyjee
    Commented Jul 21, 2017 at 6:30
  • 23
    Since 63.0.3239.132 this does nothing. The rule seems to be disregarded and even custom domains that link to localhost is now redirected to https. Annoying factor to have to use self-signed certificates for everything...
    – Daniel
    Commented Jan 5, 2018 at 8:59
  • 6
    Alternative solution - chrome has an allowlist of sites that can use insecure content (http). Go to chrome://settings/content/insecureContent and you can add sites to the list named Allowed to show insecure content.
    – ethaning
    Commented Oct 9, 2023 at 14:55
265

My problem came from having a .dev domain, which was apparently recently registered as a gTLD and put in a commit to Chrome Canary. I found this out from a recent post I came across as I searched for my problem.

If you have the same problem I do, it appears that the best solution is to change your domain to be something other than .dev. The article suggested .test with a potential solution of .localhost later down the road (via this proposal).

Improve this answer
21
  • 52
    This was the issue for me as well. On my local development machine I utilized .dev for almost 10 years now. I did a recent Google Chrome update and it started redirecting all of my sites to https for no reason I could understand. Would have never thought it had to do with the .dev, then I came across this answer and changed it to .development and all works well again ... For now :-) . Thanks again!
    – conrad10781
    Commented Dec 8, 2017 at 20:04
  • 23
    Perfect! I don't understand why Chrome will do something like that, it's very annoying as I have nearly 30 .dev domains in my local. Hope it's a very, very good reason.
    – Pablo Ezequiel Leone
    Commented Dec 11, 2017 at 9:00
  • 4
    I have wordpress installed, changing its domain might be a real headache. same for the main directory name ect. is there any other way around?
    – Rick Sanchez
    Commented Dec 11, 2017 at 16:26
  • 10
    It's because Google bought .dev and presumably will start making public sites using it.
    – Hilton Shumway
    Commented Dec 11, 2017 at 18:41
  • 24
    FML… I almost gave up on my 10+ year web dev career because of this. #starbucksbarista
    – elbowlobstercowstand
    Commented Dec 13, 2017 at 22:34
33

To delete domain under "HSTS" menu in chrome://net-internals is a temporary solution. After visiting this domain over HTTPS it will be included in HSTS list again.

Basicaly, to solve this issue it is necessary to disable HTTP Strict Transport Security on the web-server 3rdrevolution.com (IIS, Apache, nginx,...). For nginx edit its HTTPS section in nginx.conf and set 'max-age=0' for Strict-transport-Security:

server {
#...
        ssl on;
#...
        add_header Strict-Transport-Security "max-age=0;";
#...
}

More info: HTTP Strict Transport Security (HSTS)

Improve this answer
3
  • I wasn't able to get the add_header method to work.
    – Alex Barker
    Commented Jan 26, 2016 at 6:49
  • for me the server did not issue a HSTS header so this is not a solution. From what I can tell, chrome recorded when I accidentally visited it with https and created an internal HSTS record that then mysteriously redirected me to https everytime. Fix was to use the delete HSTS record in chrome:net-internals. Had a handy checker in there as well.
    – rob
    Commented May 15, 2017 at 13:53
  • 2
    To delete HSTS record is a temporary solution. You will get this record in chrome again and again after visit https untill server send "max-age=0".
    – user2285323
    Commented May 16, 2017 at 17:46
22

https://www.3rdrevolution.com sends the Strict-Transport-Security header so accessing it over https once will make browsers like Chrome/Firefox redirect http requests to https until some specified point in the future.

As the other answer said, the only way to stop this once it starts is to clear the browser cache (or wait for the browser to expire the order).

Improve this answer
15

There could be a couple of reasons for this, including plugins but assuming that you do not have any plugins installed you can do the following:

Goto Settings/Privacy/Clear Browsing Data...

Select The Beginning of Time in the pull down.

Select:

  • Clear saved Autofill form data
  • Delete cookies and other site and plug-in data
  • Empty the cache

Select Clear Browsing Data

This should take care of it doing any Auto-fill based on your previous browsing. Also, it will remove any of the cookies that could also be causing problems.

Improve this answer
4
  • The problem for me was the cache. I was able to go to my http site fine in firefox and a chrome incognito window. There were no cookies for the site.
    – anon
    Commented Aug 29, 2016 at 14:40
  • 1
    This also worked for me where the HSTS did not. I only had to check the "Images and Files" checkbox.
    – dmgig
    Commented Mar 1, 2017 at 16:16
  • This worked for me, while HSTS and other solutions did not.
    – AllisonC
    Commented Apr 7, 2017 at 13:54
  • This worked for me as well.
    – jcubic
    Commented Oct 24, 2018 at 15:17
14

From https://galaxyinternet.us/google-chrome-redirects-localhost-to-https-fix/

None of the option fixes worked for me, for fixing https://localhost:3000, this did.

Click and hold reload button and select “Empty Cache and Hard Reload,” this seems to only be an option on localhost.

Screenshot of the “Empty Cache and Hard Reload” option.

Improve this answer
1
  • 6
    To make this work on Chrome Version 77.0.3865.90 (Official Build) (64-bit) (MacOS), I had to do this [1] (after opening problematic page) Right click anywhere and click on Inspect [2] After the inspect frame appears, click and hold on reload button [3] in the drop-down that appears, click on Empty Cache and Hard reload
    – y2k-shubham
    Commented Sep 27, 2019 at 7:55
7

If you are facing the problem on a subdomain then this line in Nginx might cause a problem even if the subdomain is in another server, as the browser will cache this information.

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

so remove the includeSubdomains; of it to make it work.

Improve this answer
1
  • yes, thanks for pointing this important point.
    – Himalaya Garg
    Commented Jan 22, 2021 at 11:57
6

A less drastic alternative than clearing all cookies ever is Settings>Show advanced settings>Content Settings>All Cookies and site data then search for the sites in question and clear cookies for only those.

Improve this answer
2
  • Thanks this works perfectly. I don't know why Chrome makes this such a hidden feature.....well actually, I can guess why...
    – ktec
    Commented Dec 6, 2016 at 10:05
  • 1
    this doesn't seem to work with current Chrome version.
    – Vylix
    Commented Jul 17, 2018 at 3:01
5

Before few days I accidentally turned on Chrome options named:

  • Automatically send some system information and page content to Google to help detect dangerous apps and sites
  • Protect you and your device from dangerous sites

And now the main problem was that our website on subdomain always redirect from http:// to https:// and browser gave me an error:

"Your connection is not private. Attackers might be trying to steal your information from censored.censored.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID"

Open chrome://settings/privacy and turn previously named chrome options that automatically protect your devices. Hope this will help someone.

Improve this answer
1
  • Didn't seem to work for me.
    – Dave Burton
    Commented Oct 11, 2017 at 9:43
3

in Chrome 66, lots have changed in the Settings tab

you can just go to chrome://settings/resetProfileSettings?origin=userclick then hit reset.

this worked for me.

Improve this answer
1
  • 7
    This will reset ALL your settings.
    – Rafal Enden
    Commented Feb 27, 2020 at 15:05
0

For me developer mode was the answer. (Ctrl-Shift-I, long mouse press on "reload" icon for making a menu appear, "empty cache & hard reload".)

I have to guess, but cleaning even HSTS downloaded data (=files?) seemed to have killed some buffered automatism that always caused a http to https change even before the first real server access for the given input was done.

https://stackoverflow.com/questions/38968510/how-to-permanently-exclude-localhost-from-hsts-list-in-google-chrome

Improve this answer
0

Using Firefox v129.0.1 in 2024, what worked for me to prevent redirecting http://localhost to https://localhost was:

  • go to about:config
  • search for the key browser.fixup.fallback-to-https
  • set it to false

I suspect that this will run into some side effects, but I need to get to localhost.

Improve this answer
2
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Aug 30 at 7:44
  • I added this answer in hopes that it will help someone out, not to satisfy some bot. Piss off bot.
    – Jim Naumann
    Commented Aug 31 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .