Geek Answers Handbook

Chrome and Firefox automatically redirect to https on a specific site

I have a drupal site that runs on nginx and php-fpm with haproxy balancing between multiple servers.

I have two services configured for haproxy: http and https.

if I go to http://subdomain.domain.com it works fine.
If I go to https://subdomain.domain.com , it also works great. If I go back to http, it now redirects to https. This happens in firefox and chrome, but not in IE.

Is there some kind of setup somewhere that automatically redirects to https if it knows that it exists? Perhaps if a secure header is set?

I tried to watch LiveHTTPHeaders, but at the moment it shows only part of https.
I tried looking in Chrome and it says the following:

t=1312233405229 [st= 0] +REQUEST_ALIVE [dt=192] t=1312233405229 [st= 0] URL_REQUEST_START_JOB [dt= 0] --> load_flags = 1114241 (ENABLE_LOAD_TIMING | MAIN_FRAME | VALIDATE_CACHE | VERIFY_EV_CERT) --> method = "GET" --> priority = 0 --> url = "http://subdomain.domain.com/" t=1312233405229 [st= 0] +URL_REQUEST_START_JOB [dt= 0] --> load_flags = 1114241 (ENABLE_LOAD_TIMING | MAIN_FRAME | VALIDATE_CACHE | VERIFY_EV_CERT) --> method = "GET" --> priority = 0 --> url = "http://subdomain.domain.com/" t=1312233405229 [st= 0] URL_REQUEST_REDIRECTED --> location = "https://subdomain.domain.com/"

He seems to be doing a redirect, but doesn't say why.

I tried sniffing Wireshark, but could not understand, because I can not get SSL decryption to work (I have a key).

+4
source share
1 answer

I get it. I had a setting in nginx: add_header Strict-Transport-Security "max-age = 7200"; This is a new feature supported by chrome and firefox 4: chromium.org/sts

+5
source

More articles:


All Articles