3 ms·

In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com https://example.com , probably because I've visited the http

In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com https://example.com , probably because I've visited the https site before and they remember that. So I do not recommend example.com .

kees99 7y ago
Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox. There should be no forced https redirection if you fill in http:// http:// prefix by hand though. At least for now, until example.com adds HSTS headers.
shakna 7y ago
I don't think the IANA domains make use of HSTS or anything of the like. HTTP/2.0 304 Not Modified cache-control: max-age=604800 date: Sat, 02 Nov 2019 22:22:19 GMT etag: "3147526947+gzip" expires: Sat, 09 Nov 2019 22:22:19 GMT last-modified: Thu, 17 Oct 2019 07:18:26 GMT server: ECS (sjc/4E71) vary: Accept-Encoding If you type "example.com" into the URL, both Firefox and Chrome will try HTTPS first. If you want plain HTTP, you just need to ask for it: "http://example.com" http://example.com"
- Thorrez 7y ago
  I don't think HTTPS is the default automatically. When I create a new Chrome profile, then type example.com into the url bar and hit enter, I go to http://example.com http://example.com . Then when I type https://example.com https://example.com twice (each time hitting enter) then type example.com and hit enter, I go to https://example.com https://example.com . So I think it might be whichever is more common in your history. Firefox behaves very similarly, except I don't have to visit https://example.com https://example.com twice before it becomes the default, I just have to visit it once.
  - ramshorns 7y ago
    This could also happen because of an extension like HTTPS Everywhere, which requests the https by default when both are available.
    - amarshall 7y ago
      HTTPS Everywhere uses built-in rules, not heuristics, to determine when to rewrite an HTTP request to HTTPS. There does not appear to be a rule for example.com, so HTTPS Everywhere does not cause a rewrite.
      - shakna 7y ago
        It also sends the "Upgrade-Insecure-Request" header, which can cause that switch to take place.
amarshall 7y ago
For Firefox, this may occur when the address bar autocompletes from history, pulling the https:// https:// entry. As far as I can tell, it doesn’t have anything to do with prioritizing HTTPS, just whichever is more frequent in your history (if you visit the HTTP enough times it will switch to picking that for autocomplete). If you don’t use the autocomplete entry (for example, by tab-completing it but deleting the trailing slash), then it will use HTTP unless you actually typed https:// https://.
organsnyder 7y ago
The Firefox instance I'm using at the moment goes to the non-TLS version when I type "example.com" in the address bar.

kees99 7y ago

Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox. There should be no forced https redirection if you fill in http:// http:// prefix by hand though. At least for now, until example.com adds HSTS headers.

shakna 7y ago

I don't think the IANA domains make use of HSTS or anything of the like. HTTP/2.0 304 Not Modified cache-control: max-age=604800 date: Sat, 02 Nov 2019 22:22:19 GMT etag: "3147526947+gzip" expires: Sat, 09 Nov 2019 22:22:19 GMT last-modified: Thu, 17 Oct 2019 07:18:26 GMT server: ECS (sjc/4E71) vary: Accept-Encoding If you type "example.com" into the URL, both Firefox and Chrome will try HTTPS first. If you want plain HTTP, you just need to ask for it: "http://example.com" http://example.com"

Thorrez 7y ago
I don't think HTTPS is the default automatically. When I create a new Chrome profile, then type example.com into the url bar and hit enter, I go to http://example.com http://example.com . Then when I type https://example.com https://example.com twice (each time hitting enter) then type example.com and hit enter, I go to https://example.com https://example.com . So I think it might be whichever is more common in your history. Firefox behaves very similarly, except I don't have to visit https://example.com https://example.com twice before it becomes the default, I just have to visit it once.
- ramshorns 7y ago
  This could also happen because of an extension like HTTPS Everywhere, which requests the https by default when both are available.
  - amarshall 7y ago
    HTTPS Everywhere uses built-in rules, not heuristics, to determine when to rewrite an HTTP request to HTTPS. There does not appear to be a rule for example.com, so HTTPS Everywhere does not cause a rewrite.
    - shakna 7y ago
      It also sends the "Upgrade-Insecure-Request" header, which can cause that switch to take place.

amarshall 7y ago

For Firefox, this may occur when the address bar autocompletes from history, pulling the https:// https:// entry. As far as I can tell, it doesn’t have anything to do with prioritizing HTTPS, just whichever is more frequent in your history (if you visit the HTTP enough times it will switch to picking that for autocomplete). If you don’t use the autocomplete entry (for example, by tab-completing it but deleting the trailing slash), then it will use HTTP unless you actually typed https:// https://.

organsnyder 7y ago

The Firefox instance I'm using at the moment goes to the non-TLS version when I type "example.com" in the address bar.