5 ms·
I find that many sites implement HSTS and the redirect to HTTPS wrong. For example, they will have http://example.com http://example.com redirect to https://www
by mcculley 5y ago
I find that many sites implement HSTS and the redirect to HTTPS wrong. For example, they will have http://example.com http://example.com redirect to https://www.example.com https://www.example.com instead of first redirecting to https://example.com https://example.com. According to the spec, the browser will not automatically upgrade to HTTPS next time, leaving that first request still open to attack.
[Kind of a plug: I made a test for this in my tool, DomainProactive (https://domainproactive.com https://domainproactive.com). I would appreciate feedback on this kind of error.]
- boring_twenties 5y agoIndeed. I now have firefox configured to always try HTTPS first. A warning pops up if it doesn't work, and you have to click through it if you want to proceed. It turns out that a large number of sites not only have http://example.com http://example.com redirect to https://www.example.com https://www.example.com, as you describe, but https://example.com https://example.com doesn't work at all -- resulting in this warning. Clicking through it, you end up at https://www.example.com https://www.example.com.