Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Some time ago i had found a possibility to prevent the browser to establish any unsecured connections to a server. I already redirect my users from HTTP to HTTPS but if a user sends a Request with sensitive data to http first and gets a redirect to HTTPS the data already has send to the server via HTTP.

share|improve this question
    
You should enter your "Update" as an answer and accept it. –  wfaulk May 8 '12 at 21:32
    
the accept part is missing. ;-) –  Jonathan May 9 '12 at 8:06

3 Answers 3

There is absolutely nothing you can do to prevent anyone from sending data in clear text. The only control you have is how your server responds to it, if at all. With that in mind, I suggest you use normal means to either reject the request outright or to simply redirect it to HTTPS. Realistically there is nothing else you can do.

share|improve this answer

You could configure the webserver to not listen on port 80. This way there will be no TCP Handshake and the browser will not even send his first data packet. Obviously then the redirection will not work any more.

share|improve this answer
up vote 1 down vote accepted

I was searching for the HTTP Strict-Transport-Security Header. http://hacks.mozilla.org/2010/08/firefox-4-http-strict-transport-security-force-https/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.