0

I am currently redirecting HTTP to HTTPS through Virtual Host with the following line:

Redirect permanent / https://www.example.com/

The problem I get is when I check it on https://asafaweb.com I get the following warning:

The address you entered makes a request using the HTTP scheme but is then redirected by the server to an HTTPS address.

Checking out google for example you get the following message:

The address you entered uses the HTTP scheme and the response was also in the HTTP scheme so this test has passed.

And I can't figure out what I am doing wrong. I've also got HSTS enabled if that matters at all.

1
  • The problem is probably not your server configuration but rather in your content. Check your html/code for one or more absolute links that include http:// resources rather than either relative links to resources or https://...
    – HBruijn
    Apr 25, 2018 at 18:10

1 Answer 1

2

This is fine, is normal and is expected.

By default the web currently is unencrypted (HTTP). So when you type www.example.com into your browsers address bar it will go to http://www.example.com instead of https://www.example.com by default. If you're a secure website you'll redirect it to https://www.example.com.

That means there is (small) period when the traffic is unencrypted. there's a few dangers with this:

  1. Any cookies you have for www.example.com will be sent on that first, unencrypted, request unless you mark the cookies with a Secure flag.
  2. You could be redirected to another site (http://www.evilexample.com) instead of https://www.example.com if someone listens in in the middle an intercepts that initial redirect (a Man in the Middle Attack - MITM)
  3. The MITM attacker could drop the redirect and keep you on http://www.example.com and then pass data back and forth between you and https://www.example.com so it all looks OK but is completely unencrypted so, unless you happened to look at the browser URL, you might not notice it.

So, ideally you would not be on HTTP and go direct to HTTPS. At some point the web will flip, and try HTTPS first, and then fall back to HTTP is that doesn't work, but for the moment it's HTTP by default.

So this website is basically just warning you to this fact.

What can you do about this warning? Well you can't do anything to get rid of this warning - except to enter the URL with https:// at the beginning instead of http://, which is one way around this. So, when giving out your URL or linking to it, use https://.

You can (and should!) also set the Secure flag on any cookies you don't want read over HTTP, but that won't help with this website warning, but at least solves one of the risks above.

Finally you can use HSTS, as you say you are using. HSTS allows you to tell your browser that you don't want to use HTTP by default, but want to use HTTPS only. The way it works is that the first time you connect to the website over HTTPS (whether directly or after a redirect) the website tells the browsers with a special Strict-Transport-Security HTTP Header that you have configured your website to return, to only use HTTPS in future - even if the user forgets the scheme (www.example.com) and in fact even if they don't forget the scheme but give it as HTTP (http://www.example.com). So this is safer but that very first connection to the website, until they get that header, is still at risk (or if the browser forgets the Strict-Transport-Security setting as it's only cached for the time you tell it for). So, while it's good, it won't help with this scan.

The next step you can take (and please do not take this step without understanding the consequences) is to preload this HSTS setting into the browsers code using this website: https://hstspreload.org/. This will protect that very first visit (if you are using a browser that uses this preload list - which most modern browsers do). However it will prevent your domain being able to use HTTP at all so if you have any websites which are not on HTTPS (e.g. http://blog.example.com, or http://intranet.example.com or http://development.example.com) then you'll have just forced yourself to upgrade them. To be honest I think preloading is overkill for most sites IMHO. Even if you do preload, https://asafaweb.com/ doesn't seem to use the preload list so your will still get that warning.

All in all, my best advice is to heed the warning, read the links they've given, understand what the warning means and put as many mitigations against it in place as you can, and move on :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .