1

Suppose you have a website http://example.com

Now, you also have an SSL certificate, which means users can access the site securely using https://example.com

But if I just write http://example.com in the address bar, how can the client get to convert it to https://example.com when it didn't use the HSTS response header (which forces the client to use https).

In other words, if I go to port 80, how am I redirected to port 443?

forest
  • 64,616
  • 20
  • 206
  • 257
Utkarsh Agrawal
  • 493
  • 1
  • 8
  • 15

1 Answers1

6

The site is manually redirecting you to the HTTPS version of the site, typically using the HTTP 301 redirect status code. This is not as secure as HSTS because it is vulnerable to a MITM attack, but it does cause you to transparently switch to the encrypted version of the site. This behavior must be configured in the server to work. The server can either be made to automatically perform the 301 redirect on all pages, or only for certain pages such as those with password input fields.

The client first sends a request to the non-encrypted version of the site:

GET /index.html HTTP/1.1
Host: www.example.com

The site then responds with a redirect:

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/index.html

This instructs your browser to send another GET request, this time to port 443 with TLS.

Note that, even when HSTS is used, this is still necessary for the first connection. HSTS headers are only allowed to be set over the HTTPS protocol, so a redirect is usually used to tell the browser to use the encrypted protocol the first time. Only after that will the browser remember that it should rewrite all requests to the encrypted version of the site without being told first.

forest
  • 64,616
  • 20
  • 206
  • 257
  • but Is the site redirecting because it uses SSL Certificate? Or we place 301 redirections on every page of Site? – Utkarsh Agrawal Jul 05 '18 at 05:11
  • 1
    @UtkarshAgrawal The website can be configured to do this automatically for every page, or only for certain pages. Of course, it only works if you have a certificate. Otherwise the redirect will break. – forest Jul 05 '18 at 05:11
  • Thanks, it helps, but one thing more, i.e. How it will do automatically, I mean I want to get a clear picture about. – Utkarsh Agrawal Jul 05 '18 at 05:14
  • @UtkarshAgrawal Are you asking what the actual configuration file looks like? – forest Jul 05 '18 at 05:14
  • Yes, if it is possible? – Utkarsh Agrawal Jul 05 '18 at 05:16
  • 1
    I've edited the answer to [link to an example](https://www.aleydasolis.com/htaccess-redirects-generator/https-vs-http/) for htaccess. – forest Jul 05 '18 at 05:16