1

If I go to google.com in my browser, it automatically loads the https site.

When I do curl http://www.google.com, if it were doing a redirect, then I'd expect to see a 301 message. But instead, it appears to show the code for the page.

Does this mean then that it is doing a rewrite to https instead of a redirect?

Improve this question

2 Answers 2

Reset to default
1

This is calling Strict Transport Security or better known as HSTS

Google and so on are hardcoded with a HTTPS-response to a HTTP-request. If you open in the Chrome-Browser: chrome://net-internals/#hsts you get the hint:

HSTS is HTTPS Strict Transport Security: a way for sites to elect to always use HTTPS

with a link to https://www.chromium.org/hsts

In section Preloaded HSTS sites is a full list with all the sites that are delivered in https-only. (The chromium-sourcecode for this is https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state_static.json )

Additional you can read about HSTS in Wikipedia: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

So the things you can do is a normal 301 Moved Permanently Redirect or (theoretically to complete the options) if you have good arguments, you can try to bring your https redirect in the codebase of all browsers.

Improve this answer
4
  • 1
    This may be incorrect, I believe HSTS (if used) is communicated to the client in a HTTP header and not via DNS. It tells the client to only use HTTPS for subsequent visits, and separately the server redirects to the HTTPS version of the site. HSTS only affects future connections, not the first one coming via HTTP.
    – Tom Brossman
    Commented Mar 2, 2016 at 22:42
  • @Tom Brossman: Yes I think you are right. I will fix my answer.
    – Varon
    Commented Mar 2, 2016 at 22:51
  • 1
    This is a thorough answer describing HSTS but OP's question was about something different. They asked "How to tell if a website is using rewrite or redirect?" and this doesn't answer that question. Google's website was just used as an example and the answer should be more general so it applies to any website.
    – Tom Brossman
    Commented Mar 3, 2016 at 10:45
  • When I load google.com in Chrome I don't see a 307 error and when I look at the headers for the https site I don't see the Strict-Transport-Security header. Both of these things are indications that HSTS is being used but they're not there. Why are these things missing, and how else can you determine that HSTS is being used?
    – Tony
    Commented Mar 3, 2016 at 18:39
1

Your options are limited because you are relying on the server operator to send the correct HTTP status codes and this is not guaranteed to happen. Many websites will return a 200 OK response with their custom 404 Not Found page, for example, and this is just wrong.

The simplest way to test is to use curl's -I option which returns the header only. curl -I http://www.example.com will display a much shorter response beginning with the HTTP status code. If the server operator has correctly configured things, you will see if a 3XX Redirect response is returned.

Varon's answer here describes why this is happening for Google's website which is what you used as an example in your question. My answer here is a more general response that you can attempt to use for any site, but again you are relying on the server giving the correct response which you just can't depend on.

Improve this answer
2
  • curl -I http://www.google.com shows a 200 response and not a redirect response. How is it then that when this address is loaded in a browser the url changes to https?
    – Tony
    Commented Mar 3, 2016 at 18:42
  • When I try I see a HTTP/1.1 302 Found, not a 200 response. You are asking multiple totally different questions here (1) "How to tell if a website is using rewrite or redirect?" and (2) "How is it then that when this address is loaded in a browser the url changes to https?" The answer to your first is mine, the answer to your second is Varon's. I think maybe you should edit your question title to "How does Google enforce HTTPS connections to their websites" and accept Varon's answer, It's a good one and I suspect that's the one you are after.
    – Tom Brossman
    Commented Mar 3, 2016 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.