News for hackers. Stuff that matters.

A comment on Consider disabling HTTPS auto redirects. Parent comment

Re:Consider disabling HTTPS auto redirects by JoshTriplett on Monday June 27, 2022 @11:09AM (#31895633)
Your browser can redirect to HTTPS, if you use HSTS preloading.

Also, at this point I think we have sufficiently pervasive availability of HTTPS that it'd be reasonable for browsers to expand typed domains (if the user types `example.org`) to use https:// rather than http:// , unless they're an IP address or localhost.

[ Parent | on HN ]
Re:Consider disabling HTTPS auto redirects by mcpherrinm on Monday June 27, 2022 @11:16AM (#31895752)
I believe the chrome address bar defaults to https now: https://blog.chromium.org/2021/03/a-safer-default-for-naviga...
[ Parent | on HN ]
Re:Consider disabling HTTPS auto redirects by remram on Monday June 27, 2022 @11:12AM (#31895676)
HSTS preloading requires that you have the redirection on your site though, as per "Submission Requirements" on https://hstspreload.org/
[ Parent | on HN ]
Re:Consider disabling HTTPS auto redirects by toast0 on Monday June 27, 2022 @11:59AM (#31896432)
FWIW, it doesn't require (or at least check) that you redirect for your whole site, just / on the apex domain. I've got a larger post elsewhere in the thread with detailed recommendations for how to use HSTS for modern browsers and let old browsers do http.
[ Parent | on HN ]
Re:Consider disabling HTTPS auto redirects by JoshTriplett on Monday June 27, 2022 @11:14AM (#31895699)
Which is one of many good reasons why you should have that redirection enabled. Or disable HTTP entirely (the HSTS requirements say "if you are listening on port 80").
[ Parent | on HN ]
Re:Consider disabling HTTPS auto redirects by ta220627 on Monday June 27, 2022 @11:15AM (#31895731)
Firefox does this (if you tell it to) and it's in the works for Chromium as well IIRC.
[ Parent | on HN ]