This affects a lot of thank-you pages from 3rd party carts, etc. Are GET requests to HTTP that are redirect to HTTPS secure? Or, can they be snooped before the redirect takes place?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
As secure as going directly to HTTPS from HTTPS? No.
More secure than not redirecting? Yes.
The attack vector when redirecting from HTTP to HTTPS is that a MITM could modify the redirect to redirect the user to a non HTTPS version instead (aka. SSL stripping or a HTTPS downgrade attack). Navigating directly to HTTPS (or being taken there from a HTTPS page) would prevent this entirely, but redirecting the user from a non-HTTPS page still has the following security benefits:
HSTS attempts to address this, but it's still vulnerable if the very first request containing the Strict-Transport-Security header takes place over plain HTTP.
Before the https got place, they are simple HTTP over TCP connections. Yes, it can be snooped, but really not easily. Maybe a little bit of dns spoofing can be usable in most such cases.
A naive sloop were hard, the TCP has session id which is maybe not very long, but obstacles such tries. AFAIK in such cases the dns spoofing is a viable alternative.
Anyways, it is surely much better as if the redirect didn't existed (visitor incapable to type "https" in address line would fall out), and also much better if instead of redirect, the visitor got a purely encryption-free site.