Missing HTTPS Redirect Exposes Traffic to Interception
What Is This Vulnerability?
When your application does not redirect HTTP requests to HTTPS, users who type your domain without the https:// prefix or follow plain HTTP links send their initial request in cleartext. This exposes cookies, session tokens, and form data to anyone who can observe the network traffic, including attackers on public Wi-Fi networks.
Why It Happens
Many hosting platforms handle HTTPS termination at the load balancer but do not automatically redirect HTTP traffic. Developers assume the CDN or reverse proxy handles it, but without explicit redirect rules, the HTTP endpoint remains active and serves content over an unencrypted connection.
Example Code
import express from "express";
const app = express();
// No HTTPS redirect, serves content over HTTP
app.get("/", (req, res) => {
res.send("Welcome to the app");
});
app.listen(80, () => {
console.log("Server running on port 80");
});import express from "express";
const app = express();
app.use((req, res, next) => {
if (
req.headers["x-forwarded-proto"] !== "https" &&
process.env.NODE_ENV === "production"
) {
return res.redirect(301, `https://${req.hostname}${req.url}`);
}
next();
});
app.get("/", (req, res) => {
res.send("Welcome to the app");
});
app.listen(80, () => {
console.log("Server running on port 80");
});How Hackers Exploit It
An attacker on the same network (coffee shop Wi-Fi, hotel network, compromised router) performs a man-in-the-middle attack on HTTP connections. They intercept the cleartext request, steal session cookies, inject malicious scripts into the response, or redirect the user to a phishing page. This attack is known as SSL stripping.
How to Fix It
Configure your server or reverse proxy to redirect all HTTP requests to HTTPS with a 301 status code. Enable HSTS (Strict-Transport-Security) with a long max-age to instruct browsers to always use HTTPS for your domain. Submit your domain to the HSTS preload list for protection on the very first visit.