I agree with you on things like CORS, but HSTS would actually solve the problem stated in this thread quite gracefully. Client fetches http, notices the header

I agree with you on things like CORS, but HSTS would actually solve the problem stated in this thread quite gracefully. Client fetches http, notices the header, retries https then ... ok no, lol. But I guess it's still of some use to let clients know "this should always happen through https" and make them fail if that's not the case. Edit: yeah I got it, client fetches http, notices the header and then explicitly fails because HSTS is there.