Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I maintain a retail store's eCommerce website, provided by a 3rd party. The HTTPS links do not load ('ERR_CONNECTION_TIMED_OUT') unless you put in the WWW before the doman name. The HTTP links forward to their respective www counterparts. This 3rd party has explained that HTTPS links would need to be forwarded to the www URLs as well but "Webforwards do not forward https." I am left with a sense that this will not be followed up on. Practically speaking, I don't think we will have any shoppers manually going in and typing https://store.com and encountering this issue. However, it doesn't seem to be good practice. I checked google, yahoo, bing, shopify, and bankofamerica all forward you to their www if you do just https://domain.com. What makes this not commonplace? It looks like Amazon forwards you to their standard http if not on a need-to-be-secure page.

Is there a security hole that could arise as a result of forwarding https://example.com requests to https://www.example.com? Why would anyone want to have an error when you could have it forward to somewhere?

share|improve this question
add comment

1 Answer 1

If non-www links don't work it will also not work if you try to redirect such a link to another link, because it first needs to access the first link before it can get a redirect from there to the second link. And while it is hard to get any useful data from your error description I would recommend, that you check the problem yourself: a common problem is that the certificate for the site is for www.example.com and does not include example.com, so that latter will fail with an SSL error. In this case you would need to get a better certificate, redirecting will not work.

But, if you would achieve the forwarding (which I don't believe you can for the reasons above) it will not be a security risk, as long as the source of the redirect and the target of the redirect are both under the same control. E.g it will be a risk if you redirect it to a 3rd party side, because you don't have any control what the 3rd party side is doing.

share|improve this answer
    
Please re-read the question as I have updated it to be more thurough –  salt Jun 21 at 6:50
    
@salt: I hope this answers your question regarding the security risk. But again, if the non-www page will not load you will not be able to do a redirect from there to the www page. –  Steffen Ullrich Jun 21 at 6:56
    
The non-secure non-www links forward to their respective www links. It seems to be just the https. –  salt Jun 21 at 7:04
    
@salt: Like I said, check the specific error you get when trying to access the secure non-www link and if its a certificate problem you need a certificate with the non-www name in it. –  Steffen Ullrich Jun 21 at 7:43
    
It specifically times out. Always –  salt Jun 21 at 16:06
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.