4 ms·
It's not just frowned upon. Having a 302 redirect is almost as insecure as not upgrading to https at all. In browsers this is sort of acceptable because they l
by tinco 14y ago
It's not just frowned upon. Having a 302 redirect is almost as insecure as not upgrading to https at all.
In browsers this is sort of acceptable because they let you visually confirm that you've been upgraded to https, and are now securely connected to the right server.
In a text mode app that does the connection behind the scenes and fully automatically, there's no such confirmation or even intervention, so there's no perceptible difference between http and http 302 to https.
Ruby (on Rails) values convention over configuration. It should have made https obligatory per default and overrideable with a flag per this guideline.
- vidarh 14y ago> In a text mode app that does the connection behind the scenes and fully automatically, there's no such confirmation or even intervention, so there's no perceptible difference between http and http 302 to https. This assumes the client doesn't kick up a fuzz. The entire point is Bundler now does kick up a fuzz. But it could also be made to follow any redirect first, and only kick up a fuzz if the final resource is not https.
- ptomato 14y agoThat really doesn't provide any security advantage over just using http. The point of https is to prevent mitm and in this case there's nothing preventing somebody from mitming the original http connection and redirecting to an evil https site.
- singlow 14y agoIt could only allow redirect to the same domain and complain if a cert check failed.