• baatliwala@lemmy.world
      link
      fedilink
      English
      arrow-up
      32
      ·
      11 months ago

      Funniest thing I’ve ever seen is the docs for Nginx do the same, no http to https redirection. I mean, you would hope that the maintainers for the biggest web server in the world would be able to manage that but somehow… No they don’t.

      • gatelike@feddit.de
        link
        fedilink
        English
        arrow-up
        9
        ·
        11 months ago

        server serves a protocol on a port. I would rather it not include logic like that. turn off the http port of you don’t want to serve http.

        • azertyfun@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          14
          ·
          11 months ago

          HSTS + HTTPS redirect is the answer. It’s industry standard for a reason: it’s just as safe as pure HTTPS since you can’t get anything other than a redirect over HTTP, and HSTS protects your users from future attempted MITM attacks. The MDN page for HSTS explains it all very clearly.

          Any other implementation is an immediate audit fail in my experience.

          There’s no tangible security benefit to fully disabling port 80, and if anything depending on the service it may just drive users away to shadier alternatives.

        • baatliwala@lemmy.world
          link
          fedilink
          English
          arrow-up
          12
          arrow-down
          2
          ·
          11 months ago

          that would mean anyone going to http:// will perceive as the server being down so what you are saying will not work in practice

        • Lexi Sneptaur@pawb.social
          link
          fedilink
          English
          arrow-up
          3
          ·
          11 months ago

          So if this site has both HTTPS and HTTP versions, and it’s just Shakespeare, does it matter that much? I figure not which is why it’s not auto redirecting

      • Takios@feddit.de
        link
        fedilink
        English
        arrow-up
        15
        arrow-down
        1
        ·
        11 months ago

        SSL (or TLS nowadays) not only protects against surveillance but also guarantees the integrity of the data you send and receive. Without it, someone could spoof the response you receive. In practice this means injecting ads or malware or even worse: fake shakespeare!

    • 👁️👄👁️@lemm.ee
      link
      fedilink
      English
      arrow-up
      9
      arrow-down
      1
      ·
      edit-2
      11 months ago

      If you are using Firefox, enable https everywhere setting and it fixes stuff like that

      It will only give an error if there’s no https version that exists

      • John Richard@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        11 months ago

        No, an .htaccess file is specific to Apache HTTP Server… although some other web servers have integrated the format. However, most browsers now automatically redirect when an HTTPS version exists.