This affects a lot of thank-you pages from 3rd party carts, etc. Are GET requests to HTTP that are redirect to HTTPS secure? Or, can they be snooped before the redirect takes place?

Thank you


As secure as going directly to HTTPS from HTTPS? No.

More secure than not redirecting? Yes.

The attack vector when redirecting from HTTP to HTTPS is that a MITM could modify the redirect to redirect the user to a non HTTPS version instead (aka. SSL stripping or a HTTPS downgrade attack). Navigating directly to HTTPS (or being taken there from a HTTPS page) would prevent this entirely, but redirecting the user from a non-HTTPS page still has the following security benefits:

  • The user is vulnerable for a much shorter window, possibly only a single request
  • Users can still manually verify that HTTPS is being used and identify when redirection hasn't taken place

HSTS attempts to address this, but it's still vulnerable if the very first request containing the Strict-Transport-Security header takes place over plain HTTP.

  • Watch out for the SSLSTRIP attack. – Craig Dec 19 '14 at 8:57

Before the https got place, they are simple HTTP over TCP connections. Yes, it can be snooped, but really not easily. Maybe a little bit of dns spoofing can be usable in most such cases.

A naive sloop were hard, the TCP has session id which is maybe not very long, but obstacles such tries. AFAIK in such cases the dns spoofing is a viable alternative.

Anyways, it is surely much better as if the redirect didn't existed (visitor incapable to type "https" in address line would fall out), and also much better if instead of redirect, the visitor got a purely encryption-free site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.