Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #234191

Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 15/04/2021 11:16, piorunz wrote:
> On 15/04/2021 03:15, Celejar wrote:
>
>>> It certainly works fine for me. I use https only mode for many months
>>> now. Can you bring an example of a page which returns good page on
>>> http,
>>> but 404 error on https?
>>
>> http://www.daat.ac.il/
>> https://www.daat.ac.il/
>>
>> Celejar
>
> Their webserver is misconfigured. AFAIR, if they don't support https,
> their server should redirect to http page. Instead, they throw 404 error.

If they don't support https, they shouldn't respond at all. Receiving a
404 comes after successful TLS negotiation. With HTTPS you first
establish a TCP connection to port 443 on the server, then you establish
a TLS tunnel to the server; only once those are complete can you send
the "GET" verb over the tunnel. The server has then, securely, responded
"I don't have a page called /".

While it's common practice for HTTP  and HTTPS sites to be identical,
it's not really built in to the protocol. I could well see a situation
where a webmaster might configure, say, just the /admin part to be
accessible over HTTPS.

That said, common use is changing. It's now expected that 
http://example.com, https://example.com, http://www.example.com and
https://www.example.com all serve identical content (mostly because
humans are terrible at paying attention to the full URL and just see
that all as "example dot com".

>
> Your web browser behaviour is as intended, everything is fine.
> If webadmins of that page don't know their sh*t, are you sure you want
> to use that website? Who knows what else they forgot to implement.
>
> Disclaimer: I never worked in IT, all self taught, but I have webpage
> which I put up myself on Debian computer, with https cert (it's free),
> TLS 2.0/3.0 only, PFS, HSTS preload with long duration, OCSP stapling,
> top spec security. These guys? They can't even redirect to their http
> page.
>
>
> -- 
>
> With kindest regards, piorunz.
>
> ⢀⣴⠾⠻⢶⣦⠀
> ⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
> ⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org
> ⠈⠳⣄⠀⠀⠀⠀
>

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-14 18:20 +0200
  Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections riveravaldez <riveravaldezmail@gmail.com> - 2021-04-14 21:10 +0200
    Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Nito <nito@dismail.de> - 2021-04-15 02:40 +0200
    Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 04:30 +0200
  Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 00:00 +0200
    Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 04:20 +0200
      Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Kenneth Parker <sea7kenp@gmail.com> - 2021-04-15 05:00 +0200
        Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2021-04-15 06:00 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Kenneth Parker <sea7kenp@gmail.com> - 2021-04-15 07:20 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Dan Ritter <dsr@randomstring.org> - 2021-04-15 15:40 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS connections Kenneth Parker <sea7kenp@gmail.com> - 2021-04-15 16:40 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Richard Hector <richard@walnut.gen.nz> - 2021-04-16 03:10 +0200
                Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Tixy <tixy@yxit.co.uk> - 2021-04-16 10:40 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-16 12:40 +0200
      Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 12:20 +0200
        Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Darac Marjal <mailinglist@darac.org.uk> - 2021-04-15 12:50 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-15 14:40 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-15 14:40 +0200
        Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Greg Wooledge <greg@wooledge.org> - 2021-04-15 13:30 +0200
        Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 14:20 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2021-04-15 14:40 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Celejar <celejar@gmail.com> - 2021-04-15 17:20 +0200
          Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections mett <mett@pmars.jp> - 2021-04-15 14:50 +0200
            Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 16:20 +0200
              Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Erwan David <erwan@rail.eu.org> - 2021-04-15 16:50 +0200
                Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections piorunz <piorunz@gmx.com> - 2021-04-15 17:50 +0200
                Re: Firefox HTTPS-only mode breaks sites that return 404 for HTTPS  connections Jonathan Dowland <jon+debian-user@dow.land> - 2021-04-16 13:30 +0200

csiph-web