4 ms·
The suggestion may exist because it's possible to do nasty things if a user (particularly a logged-in user) goes to your http address. If you don't have cookie
by nopal 16y ago
The suggestion may exist because it's possible to do nasty things if a user (particularly a logged-in user) goes to your http address.
If you don't have cookies configured to use https only (you don't), an attacker can grab a user's cookies. They can also intercept your redirect and send users to another site (see sslstrip).
- mike-cardwell 16y agoI don't understand what you're talking about. My entire site is HTTPS, I also use Strict-Transport-Security, have a ruleset in HTTPS-Everywhere, and I don't use cookies at all. If I were to use cookies, I'd make sure to add the secure and httpOnly flags. Me putting a redirect on http to https is no less secure than not providing http at all.