Is there a way to force an SSL lock without using a 301 redirect, such as server side?
I'm happy to supply context if requested.
-
Redirects are sent server side. They require cooperation from the client to use them, but there isn't going to be a method that works without involving the client somehow. – Stephen Ostermiller♦ May 23 '19 at 15:24
-
2You could potentially detect HTTPS (or absence of) with JavaScript and "redirect" from the client? It's not a "301 redirect", however, it's not particularly secure. (?) – DocRoot May 24 '19 at 9:07
It's unclear to me what your use case is, but here is a solution to your question as it's worded. You can use HSTS preloading to ensure that all modern browsers always connect using HTTPS, without the need for a 301 redirect (though keeping a 301 redirect active is recommended).
Note that to be eligible for HSTS preload list inclusion, you must do one of the following:
Set up a redirect from HTTP (port 80) to HTTPS, or
Refuse all HTTP (port 80) connections
Once your site is submitted, it will take a few months for the list to be published to web browsers. Then, browsers will ONLY connect to your site via HTTPS. Removal from the HSTS preload list (and removal of HSTS in general) is messy and takes a long time, so be absolutely sure that this is the solution for you before you implement it.
answered May 23 '19 at 17:42
-
2Or buy a
.devdomain because the entire top level domain is already on the HSTS preload list. – Stephen Ostermiller♦ May 23 '19 at 17:53 -
There are many other TLDs on the preload list, or at least Google ones:
.APP,.PAGEor others:.BANK,.INSURANCE. – Patrick Mevzek Jun 3 '19 at 23:28 -
"Note that to be eligible for HSTS preload list inclusion, you must do one of the following:" Based on hstspreload.org there are some more conditions: having a valid certificate (which is kind of implied when doing WebPKI) but also provide an
strict-transport-securityheader with some constraints on values allowed. – Patrick Mevzek Jun 3 '19 at 23:33
