2

A lot of sites now default to https. Where beforehand i would have had to asked for https specifically (ie: typing out https://www.google.com) now even if I type out just www.google.com or even explicitly call http://www.google.com it will automatically go to the https version. How is this setup? is this part of the DNS records or is this a server side redirect?

migrated from security.stackexchange.com Sep 30 '14 at 2:39

This question came from our site for information security professionals.

  • 4
    This is a server side redirect; the HTTP site just redirects to the HTTPS version. If you're wondering it does present a potential vulnerability in that an attacker could block this redirect from happening, and the user may not notice that they weren't redirected to HTTPS. This is the basis for how programs like SSLstrip work. – user54791 Sep 29 '14 at 22:29
  • Which browser are you using? – curiousguy Sep 30 '14 at 3:04
6

For any given site this could be a server redirect. Alternatively, the site in question may be using HSTS - a special header that tells tour browser to only connect to the site over HTTPS.

In addition some browser (Chrome and Firefox at least) include preloaded lists of sites supporting HSTS, so your browser will never connect to them over HTTP (Without the preloaded list, your browser will try an HTTP connection before it receives the sites HSTS header for the first time - unless you manually typed https).

1

Any site that automatically forwards you to https is using a server side redirect. There are extensions for most browsers to look for https sites and connect to them if available, but browsers don't "know".

  • 1
    What about HSTS (assuming the site in question implements it)? Granted this requires visiting the site at least once. – lzam Sep 30 '14 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.