Timeline for How to force the root domain over https without a 301 redirection?
Current License: CC BY-SA 4.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 3, 2022 at 10:46 | vote | accept | Konstantinos Sakkas | ||
| Dec 9, 2021 at 1:52 | history | edited | Maximillian Laumeister♦ | CC BY-SA 4.0 |
deleted 1 character in body
|
| Dec 9, 2021 at 0:46 | comment | added | Patrick Mevzek | But redirects "work" for those absolutely wanting to keep port 80 open for connections, so YMMV. Of course for a real website existing already today it might not be wise to plug off HTTP, but for anything new starting fresh I personnally see no point in having HTTP still around. Sadely not the same can be said yet for IPv6 vs IPv4, even if it should. | |
| Dec 9, 2021 at 0:45 | comment | added | Patrick Mevzek |
There could be multiple answers to this, but it is akin to IPv4/IPv6. Things changed. If the web was invented today, it would be HTTPS immediately, no one would ever bother to consider a. "plain text" version of it. So since HTTPS is the clear present/future, why keep maintaining old stuff? Doing redirects might be fine but you need to remember doing them, they create problems for POST content (imagine a form), etc. If you start a website fresh, give only https:// links around and search engines will also only index that + browsers will default/are already defaulting to that.
|
|
| Dec 9, 2021 at 0:18 | comment | added | Maximillian Laumeister♦ | @PatrickMevzek If you don't mind me asking, what's the benefit of that compared to issuing only redirects and no other content on the HTTP port? | |
| Dec 8, 2021 at 23:01 | comment | added | Patrick Mevzek | If you do only HTTPS from the get go, you ensure to have never a plain text communication, so no content appear in the clear anywhere. | |
| Dec 8, 2021 at 20:47 | comment | added | Maximillian Laumeister♦ | @PatrickMevzek Thanks for the info. I added a note about the new browser behavior. What do you mean by "ensuring nothing is leaked?" | |
| Dec 8, 2021 at 20:45 | history | edited | Maximillian Laumeister♦ | CC BY-SA 4.0 |
added 261 characters in body
|
| Dec 8, 2021 at 18:35 | comment | added | Patrick Mevzek | "The only way to communicate to web browsers to never attempt to load your website over https" There is another very easy way: don't listen on port 80 (used for HTTP). Any new website starting now should just stop bothering with HTTP and just use HTTPS (port 443). Even if some browsers attempt port 80 they won't get any result hence ensuring nothing is leaked. | |
| Dec 8, 2021 at 18:34 | comment | added | Patrick Mevzek | "When a user types in a website URL without explicitly typing https, most web browsers will initially attempt to connect over http." This is less and less true and will be reversed in the future. See blog.chromium.org/2021/03/… "Starting in version 90, Chrome’s address bar will use https:// by default," and blog.mozilla.org/security/2020/11/17/… (for now has to be setup as a preference) | |
| Dec 8, 2021 at 18:25 | history | answered | Maximillian Laumeister♦ | CC BY-SA 4.0 |