Not Following 301 Redirect
Reported by
curtisle...@gmail.com,
Aug 3 2016
|
||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.82 Safari/537.36 Example URL: http://www.leedev.org Steps to reproduce the problem: 1. Visit http://www.leedev.org/ What is the expected behavior? Chrome should correctly follow the redirect the server returns to it. http://www.leedev.org/ -> https://leedev.org/ (notice the https and removal of www) What went wrong? Chrome acts like it redirected to https://www.leedev.org/ (notice the https). Visiting http://www.leedev.org returns a 301 redirect to https://leedev.org/ (notice the https and removal of www) $ curl -I http://www.leedev.org HTTP/1.1 301 Moved Permanently Server: nginx/1.10.1 Date: Wed, 03 Aug 2016 14:13:34 GMT Content-Type: text/html Content-Length: 185 Connection: keep-alive Location: https://leedev.org/ but Chrome is ignoring that. It then claims to be redirected to https://www.leedev.org/ (notice the https) and that the certificate is invalid. I only have the www redirect for http because some people still seem to think they must type a www before any web address. These same people wouldn't type https and www. I have also tried to work around this by setting up 2 redirects, http://www.leedev.org -> http://leedev.org (remove the www) http://leedev.org -> https://leedev.org (http to https) but Chrome still failed to properly redirect. Curl shows the redirect is set correctly and correctly follows the redirect. Example test page: $ curl -vL http://www.leedev.org/test/ * Trying 81.4.122.223... * Connected to www.leedev.org (81.4.122.223) port 80 (#0) > GET /test/ HTTP/1.1 > Host: www.leedev.org > User-Agent: curl/7.50.0 > Accept: */* > < HTTP/1.1 301 Moved Permanently < Server: nginx/1.10.1 < Date: Wed, 03 Aug 2016 16:01:15 GMT < Content-Type: text/html < Content-Length: 185 < Connection: keep-alive < Location: https://leedev.org/test/ < * Ignoring the response-body * Connection #0 to host www.leedev.org left intact * Issue another request to this URL: 'https://leedev.org/test/' * Trying 81.4.122.223... * Connected to leedev.org (81.4.122.223) port 443 (#1) * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none * TLSv1.2 (OUT), TLS header, Certificate Status (22): * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Client hello (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: CN=leedev.org * start date: Jun 10 14:20:00 2016 GMT * expire date: Sep 8 14:20:00 2016 GMT * subjectAltName: host "leedev.org" matched cert's "leedev.org" * issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3 * SSL certificate verify ok. > GET /test/ HTTP/1.1 > Host: leedev.org > User-Agent: curl/7.50.0 > Accept: */* > < HTTP/1.1 200 OK < Server: nginx/1.10.1 < Date: Wed, 03 Aug 2016 16:01:15 GMT < Content-Type: text/html < Content-Length: 117 < Connection: keep-alive < Strict-Transport-Security: max-age=63072000; includeSubdomains; preload < X-Frame-Options: DENY < X-Content-Type-Options: nosniff < <!DOCTYPE html><html><head><meta charset="UTF-8"><title>Test Page</title></head><body><p>Test Page</p></body></html> * Connection #1 to host leedev.org left intact Did this work before? N/A Chrome version: 52.0.2743.82 Channel: stable OS Version: Flash Version: Shockwave Flash 22.0 r0
,
Aug 3 2016
Thanks for the followup. Closing. |
||
►
Sign in to add a comment |
||
Comment 1 by curtisle...@gmail.com
, Aug 3 2016