4

Some pages on my website (authentication, payment) must be served over HTTPS.

When a client hits such a page over HTTP, I want to redirect it to the HTTPS version.

At the moment I'm using a 301 Moved Permanently code with a Location header that points to the same URL with the scheme modified to HTTPS.

I'm wondering: is there a specific HTTP response code for using the wrong protocol?

Something that would be similar to 405 Method not allowed for the HTTP verb.

BenMorel
  • 34,448
  • 50
  • 182
  • 322
  • Good amount of info here http://stackoverflow.com/questions/2554778/what-is-the-proper-http-response-to-send-for-requests-that-require-ssl – Brandon Johnson Oct 09 '13 at 22:21

3 Answers3

2

Not as such, no — the 301 permanent redirect is exactly the right choice here.

However, there is such a thing as HTTP Strict Transport Security (HSTS), which allows you, once you've told the browser to use HTTPS using the 301 redirect, to also tell it never to use the unencrypted HTTP protocol again on your site. The way you do this is by including a header like shown below in the HTTPS response (not in the redirect, which is sent over plain HTTP):

Strict-Transport-Security: max-age=31536000; includeSubDomains

For more details, see the Wikipedia article linked above and RFC 6797.

Community
  • 1
  • 1
Ilmari Karonen
  • 49,047
  • 9
  • 93
  • 153
0

According to this, 403.4 seems to be what you want (in IIS), but I don't believe there is an equivalent in the HTTP standard.

Vidya
  • 29,932
  • 7
  • 42
  • 70
0

Response 301 seems reasonable for the login pages etc. (where no credentials are needed to be transmitted to load the page). Otherwise when personal details have been sent it is wise to say not found (401) as somebody is being mischievous. It is also wise to check the referrer URL and also periodically check the log files.

(People do copy web sites and masquerade as yours, just forwarding traffic and collecting personal details in the process :-( )

Ed Heal
  • 59,252
  • 17
  • 87
  • 127