4 ms·
Frankly, I'm surprised the site didn't respond with a 302 redirect to SSL to avoid this kind of thing entirely (versus relying on client to specify the correct
by vageli 7y ago
Frankly, I'm surprised the site didn't respond with a 302 redirect to SSL to avoid this kind of thing entirely (versus relying on client to specify the correct protocol).
- MaxBarraclough 7y agoI don't follow. That's quite obviously not a proper fix.
- cwillu 7y agoThe client _must_ use the correct protocol, that's precisely the issue. An insecure request to switch to a secure protocol would just be elided by an attacker. If the client is coded to expect such a switch and fail if it doesn't happen, that client is at best implementing a more complicated, ad-hoc secure protocol.