HTTPS redirect

A visitor who types a domain with no scheme, or follows an old http:// link, connects over plain HTTP first. If the server answers with the page itself, everything the visitor sees and sends, including cookies, travels in clear text. The fix is a redirect: the server answers every HTTP request with a permanent redirect to the same address on HTTPS.

What a good redirect looks like

GET http://example.com/pricing
301 Moved Permanently
Location: https://example.com/pricing

• •Use a permanent status (301 or 308) so browsers and search engines remember it.
• •Redirect straight to HTTPS in one hop, keeping the path and query string. A chain through several hosts gives an attacker more places to intervene.
• •Redirect to the same host, or to the canonical host in a single step, never to a different domain.

The redirect is not enough on its own

The first request still happens over HTTP, and that is the one an on-path attacker can tamper with. The redirect closes the gap for honest visitors; HSTS then tells the browser to skip the insecure request on every later visit. Set both.

Common failure modes

• •Port 80 not answering at all, so a visitor typing the bare domain gets an error.
• •A temporary redirect (302) that never becomes permanent.
• •HTTPS pages that load scripts or images over http://, which browsers block or flag.
• •A redirect that drops the path and sends everyone to the homepage.