Hacker News Reader

Comment by grepular | Hacker News Reader

"Error generating report for https://grepular.com/ - Could not resolve address"

Is this due to HTTPS? This site really should support HTTPS...

EDIT: If I enter "http://grepular.com/ instead, it works. That URL simply redirects to the HTTPS version...

EDIT2: The only listed "problem" for my site is:

  Remove the following redirect chain if possible:
      * http://grepular.com/
      * https://grepular.com/

Don't think I'll be doing that thanks ;)

View on HN

The suggestion may exist because it's possible to do nasty things if a user (particularly a logged-in user) goes to your http address.

If you don't have cookies configured to use https only (you don't), an attacker can grab a user's cookies. They can also intercept your redirect and send users to another site (see sslstrip).

I don't understand what you're talking about. My entire site is HTTPS, I also use Strict-Transport-Security, have a ruleset in HTTPS-Everywhere, and I don't use cookies at all. If I were to use cookies, I'd make sure to add the secure and httpOnly flags.

Me putting a redirect on http to https is no less secure than not providing http at all.

Reply on news.ycombinator.com