Hacker News Reader

The suggestion may exist because it's possible to do nasty things if a user (particularly a logged-in user) goes to your http address.

If you don't have cookies configured to use https only (you don't), an attacker can grab a user's cookies. They can also intercept your redirect and send users to another site (see sslstrip).

View on HN

I don't understand what you're talking about. My entire site is HTTPS, I also use Strict-Transport-Security, have a ruleset in HTTPS-Everywhere, and I don't use cookies at all. If I were to use cookies, I'd make sure to add the secure and httpOnly flags.

Me putting a redirect on http to https is no less secure than not providing http at all.

Reply on news.ycombinator.com