"We have a redirect from HTTP to HTTPS." Some clients need more than that

The author examines the common practice of securing web services via HTTP-to-HTTPS redirects. An audit revealed that simple redirection is insufficient because the initial HTTP request already contains sensitive data, including path parameters and Cookie headers, which are transmitted in plaintext before the 301 code is received. The author urges developers to rethink traffic security, noting that modern clients and automated systems may inadvertently expose sensitive information when attempting to connect via an insecure protocol. The article details scenarios where such redirects create vulnerabilities and suggests more robust security methods, such as implementing HSTS (HTTP Strict Transport Security), to eliminate the possibility of sending HTTP requests entirely.