Hacker News Reader

Comment by Thorrez | Hacker News Reader

In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com , probably because I've visited the https site before and they remember that. So I do not recommend example.com .

View on HN

I don't think the IANA domains make use of HSTS or anything of the like.

    HTTP/2.0 304 Not Modified
    cache-control: max-age=604800
    date: Sat, 02 Nov 2019 22:22:19 GMT
    etag: "3147526947+gzip"
    expires: Sat, 09 Nov 2019 22:22:19 GMT
    last-modified: Thu, 17 Oct 2019 07:18:26 GMT
    server: ECS (sjc/4E71)
    vary: Accept-Encoding

If you type "example.com" into the URL, both Firefox and Chrome will try HTTPS first. If you want plain HTTP, you just need to ask for it: "http://example.com"

I don't think HTTPS is the default automatically. When I create a new Chrome profile, then type example.com into the url bar and hit enter, I go to http://example.com . Then when I type https://example.com twice (each time hitting enter) then type example.com and hit enter, I go to https://example.com . So I think it might be whichever is more common in your history.

Firefox behaves very similarly, except I don't have to visit https://example.com twice before it becomes the default, I just have to visit it once.

This could also happen because of an extension like HTTPS Everywhere, which requests the https by default when both are available.

HTTPS Everywhere uses built-in rules, not heuristics, to determine when to rewrite an HTTP request to HTTPS. There does not appear to be a rule for example.com, so HTTPS Everywhere does not cause a rewrite.

It also sends the "Upgrade-Insecure-Request" header, which can cause that switch to take place.

For Firefox, this may occur when the address bar autocompletes from history, pulling the https:// entry. As far as I can tell, it doesn’t have anything to do with prioritizing HTTPS, just whichever is more frequent in your history (if you visit the HTTP enough times it will switch to picking that for autocomplete). If you don’t use the autocomplete entry (for example, by tab-completing it but deleting the trailing slash), then it will use HTTP unless you actually typed https://.

Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox.

There should be no forced https redirection if you fill in http:// prefix by hand though. At least for now, until example.com adds HSTS headers.

The Firefox instance I'm using at the moment goes to the non-TLS version when I type "example.com" in the address bar.

Reply on news.ycombinator.com