Clear history of SSL redirects

Question

I am building a website, and I was debugging the code which redirects between HTTP and HTTPS versions of a page. I found that the HTTP page was always redirecting to the HTTPS page, even when I told it not to. After much tearing out of hair, I found that no redirect was actually being issued. Instead, Firefox had cached the redirect, and was redirecting itself.

This is in spite of the fact that all redirects were temporary 302 Found. At no point was a permanent redirect ever issued. Clearing the Firefox cache didn't help either. Opera and the Web-Sniffer show no redirects, while Firefox continues to redirect.

Clearing the cache usually clears all permanent redirects. Does Firefox have some special behaviour for HTTP > HTTPS redirects, whereby it remembers them even when the cache is cleared? I do not have the HTTPS Everywhere extension enabled.

Mozilla/5.0 (Windows NT 6.0; rv:16.0) Gecko/20100101 Firefox/16.0

Enabled Extensions: All-in-One Sidebar, British English Dictionary, ColorZilla, Dummy Lipsum, Execute JS, Firebug, Link Alert, Live HTTP headers, MeasureIt, RSS Icon, ShowIP, SQLite Manager, Web Developer. I don't imagine any of them will have this effect.

Is this a Firefox bug, or am I doing something wrong?

Answer 1

I have the same problem. It seems to be a deliberately coded behavior that if firefox ever connects to the https version of a site it will never again connect via http.

Clearing history and cache have never solved the problem for me, but if you completely blow away the firefox settings (rm -rf .mozilla on Linux) it will again allow you to access the http version of the site. So, it is stored somewhere in the firefox settings.

It happens to me with absolutely no redirect headers from the website, no strict transport security headers and with absolutely no firefox addons.

I have seen a lot of people post this behavior as a bug against Firefox. I have not yet seen any reaction other than disbelief. It is hard to get a bug fixed when the developers are in denial. Best thing I can suggest to you is to completely remove all firefox settings when this happens. As for end-users, I guess you just tell them not to use firefox.