Navigating to http://secure.phabricator.com/T8820 redirects to https://secure.phabricator.com instead of https://secure.phabricator.com/T8820. I've been hit by this a dozen times this week.
I don't believe that this used to be the case.
Navigating to http://secure.phabricator.com/T8820 redirects to https://secure.phabricator.com instead of https://secure.phabricator.com/T8820. I've been hit by this a dozen times this week.
I don't believe that this used to be the case.
| Restricted Diffusion Commit |
Ive typed URLs in by hand unsuccessfully a few times as well (like going to /w/). Chrome autocompletes without the https unless you have full path in your history
I think I never actually enabled HSTS on this host. I've enabled it now. Clients should refuse to establish HTTP connections, mooting this.