10. HTTPS

Although it is powerful and flexible, plain HTTP is not suitable for most web sites because it can be so easily monitored and modified. For example, anyone on the same Wi-Fi network, or any device the traffic passes through, could capture the passwords used to access a banking web site, replay requests that trigger financial transactions, or inject content into a page.

HTTPS solves this problem by sending HTTP messages over an encrypted connection created with the Transport Layer Security (TLS) protocol. TLS replaced the older Secure Sockets Layer (SSL) protocol, although the name SSL is still often used. It provides the following capabilities:

• Prevents eavesdropping
• Prevents tampering or replaying of messages
• Uses certificates to authenticate servers, and optionally clients, so that you know you are connected to the genuine web site

Apart from the encryption, HTTPS works exactly like HTTP and has the same capabilities, e.g. headers, cookies, caching, authentication, redirection, etc. Setting up a connection requires a handshake, in which the client checks the server's certificate and both sides agree on the encryption keys. TLS 1.3 completes this in a single network round trip, so the overhead is now small, and HTTP/2 and HTTP/3 (see 1. Introduction) are only used by browsers over secure connections.

For more information see RFC 9110 and RFC 8446 (TLS 1.3).

10.1 HTTPS by Default

HTTPS is now used for the vast majority of web pages, and browsers increasingly treat plain HTTP as unsafe:

• Pages loaded over HTTP are labelled Not secure in the address bar.
• An HTTPS page cannot load insecure HTTP scripts or other content (known as mixed content). Browsers either block these requests or automatically upgrade them to HTTPS.
• Chrome automatically upgrades navigations from http:// to https:// URLs when the site supports HTTPS, even if you click a link that specifies http://. Edge has a similar Automatic HTTPS feature.
• From version 154, Chrome also enables Always use secure connections by default, so it asks for your permission before it first loads a public site that does not support HTTPS.
• Many new browser features, such as service workers, are only available to pages loaded over HTTPS.

Sites can also tell browsers to always use HTTPS by returning a strict-transport-security (HSTS) header:

strict-transport-security: max-age=31536000; includeSubDomains

After receiving this header the browser will automatically use HTTPS for the site for the specified time, without ever sending an insecure request.