Redirect HTTP to HTTPS?

[Friedl]

Not intended as criticism, but I noticed that the site supports basic authentication over http, but also supports https. I saw the sticky notice on the front page to use https, but wanted to let you know, in case you didn't, that you can host different content on the TCP 80 and TCP 443 web services, and the http (port 80) one could send a HTTP 302 (or a 301, for that matter) redirect to the https. This would basically prevent users from accidentally logging into the http site with unencrypted creds.

[glasshand]

I agree. HTTPS should be the default for everything in this day and age, and visiting a site over HTTP should redirect you to the HTTPS version.

[golem]

As a developer, I endorse this suggestion.

[UrenragK]

Agreed, I thought it was already like that - we will get it sorted

[LightWingStudios]

Not intended as criticism, but I noticed that the site supports basic authentication over http, but also supports https. I saw the sticky notice on the front page to use https, but wanted to let you know, in case you didn't, that you can host different content on the TCP 80 and TCP 443 web services, and the http (port 80) one could send a HTTP 302 (or a 301, for that matter) redirect to the https. This would basically prevent users from accidentally logging into the http site with unencrypted creds.

Site updated...HTTP is now forced to the HTTPS automatically.

[Friedl]

NIce! Thanks

[glasshand]

Now, if you want to be really serious about it, you implement HSTS for the whole domain and get it put on the HSTS preload list...

[LightWingStudios]

Now, if you want to be really serious about it, you implement HSTS for the whole domain and get it put on the HSTS preload list...

Let's not get crazy given our resources and the nature of the site.