Search code examples
securityhttp-redirecthttpsbrowser-security

Do browsers follow 301 redirects from HTTP to HTTPS, on a secure site?

If I load a page https://example.org over HTTPS that contains references to HTTP resources like

 <script src="http://example.org/script.js"></script>

I understand that the browser refuses to load the script unless it's src="https://example.org/script.js".

My question is, if I implement a 301 redirect from http://example.org/script.js to https://example.org/script.js, will the browser follow the redirect and load the script via HTTPS, or will it still refuse to load it?

Solution

  • I believe browsers that block mixed content will still block a script from HTTP->HTTPS redirect.

    They certainly should do, because it's not secure. An attacker could have intercepted the HTTP request and changed it to redirect to an HTTPS address that is not the one the page referencing the script intended.