Re:Consider disabling HTTPS auto redirects
by nix23 on Monday June 27, 2022 @11:05AM
(#31895582)
I don't know why your browser cannot redirect to https and the web-server has to do it.
[ Parent
| on HN ]
Re:Consider disabling HTTPS auto redirects
by JoshTriplett on Monday June 27, 2022 @11:09AM
(#31895633)
Your browser can redirect to HTTPS, if you use HSTS preloading.
Also, at this point I think we have sufficiently pervasive availability of HTTPS that it'd be reasonable for browsers to expand typed domains (if the user types `example.org`) to use https:// rather than http:// , unless they're an IP address or localhost.
Re:Consider disabling HTTPS auto redirects
by mcpherrinm on Monday June 27, 2022 @11:16AM
(#31895752)
I believe the chrome address bar defaults to https now: https://blog.chromium.org/2021/03/a-safer-default-for-naviga...
HSTS preloading requires that you have the redirection on your site though, as per "Submission Requirements" on https://hstspreload.org/
FWIW, it doesn't require (or at least check) that you redirect for your whole site, just / on the apex domain. I've got a larger post elsewhere in the thread with detailed recommendations for how to use HSTS for modern browsers and let old browsers do http.
Re:Consider disabling HTTPS auto redirects
by JoshTriplett on Monday June 27, 2022 @11:14AM
(#31895699)
Which is one of many good reasons why you should have that redirection enabled. Or disable HTTP entirely (the HSTS requirements say "if you are listening on port 80").