5 ms·

I don't know why your browser cannot redirect to https and the web-server has to do it.

• JoshTriplett 4y ago
  Your browser can redirect to HTTPS, if you use HSTS preloading. Also, at this point I think we have sufficiently pervasive availability of HTTPS that it'd be reasonable for browsers to expand typed domains (if the user types `example.org`) to use https:// https:// rather than http:// http:// , unless they're an IP address or localhost.
  • remram 4y ago
    HSTS preloading requires that you have the redirection on your site though, as per "Submission Requirements" on https://hstspreload.org/ https://hstspreload.org/
    • JoshTriplett 4y ago
      Which is one of many good reasons why you should have that redirection enabled. Or disable HTTP entirely (the HSTS requirements say "if you are listening on port 80").
    • toast0 4y ago
      FWIW, it doesn't require (or at least check) that you redirect for your whole site, just / on the apex domain. I've got a larger post elsewhere in the thread with detailed recommendations for how to use HSTS for modern browsers and let old browsers do http.
  • ta220627 4y ago
    Firefox does this (if you tell it to) and it's in the works for Chromium as well IIRC.
  • mcpherrinm 4y ago
    I believe the chrome address bar defaults to https now: https://blog.chromium.org/2021/03/a-safer-default-for-navigation-https.html https://blog.chromium.org/2021/03/a-safer-default-for-naviga...