Consider disabling HTTPS auto redirects

Re:Consider disabling HTTPS auto redirects by remram on Monday June 27, 2022 @11:09AM (#31895636)

Using HTTPS by default has obvious security benefits, but it's not clear we need a redirect to implement it. We could have leveraged the Alt-Svc header for this instead, which is meant specifically for this. This would allow modern browsers to use HTTPS without preventing older browsers which want to use HTTP from doing so (at their own risks).

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by Ajedi32 on Monday June 27, 2022 @11:46AM (#31896211)

You can already implement this using the Upgrade-Insecure-Requests header[1]. Servers just need to check for that header and only send an HTTPS redirect if it's included. All major browsers already send that header except Internet Explorer so the security impact of such a check would be pretty minimal.

The only argument I can see against it is that it's insecure-by-default, but you could theoretically fix that by allowing clients to send `Upgrade-Insecure-Requests: 0` to explicitly indicate that they don't want to be redirected.

[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Up...

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by remram on Monday June 27, 2022 @01:49PM (#31898104)

Ah, even better! Thanks for this, I might add it to my web services.

[ Parent | on HN ]

Re:Consider disabling HTTPS auto redirects by jaywalk on Monday June 27, 2022 @11:37AM (#31896064)

There is plenty more than HTTPS that prevents older browsers from using many websites.

[ Parent | on HN ]