News for hackers. Stuff that matters.

A comment on HTTPS Watch.

Re:HTTPS Watch by jMyles on Sunday January 18, 2015 @07:49PM (#8909701)
Is it protocol at this point to always redirect from HTTP to HTTPS? Is there an RFC for that?
[ Parent | on HN ]
Re:HTTPS Watch by stephen_g on Sunday January 18, 2015 @07:55PM (#8909713)
It's part of the HSTS spec that a server receiving a request over HTTP should redirect to HTTPS.

I assume the logic here is that as it's best practice for any site with HTTPS to use HSTS also, all HTTPS sites should not be available over HTTP apart from a redirect to the secure version of the page.

[ Parent | on HN ]
Re:HTTPS Watch by AlyssaRowan on Monday January 19, 2015 @01:56AM (#8910685)
Not yet, as there was a bit of an argument in the HTTP/2 WG about that.

I may suggest a SHOULD NOT again, however.

[ Parent | on HN ]