Seguridad y SSL
Insecure Redirect
An insecure redirect occurs when a URL redirects through HTTP before reaching the HTTPS destination, or when a redirect chain includes HTTP hops. This creates a window for man-in-the-middle attacks where an attacker can intercept the unencrypted HTTP request and redirect the user to a malicious site instead.
Síntomas
- HTTP to HTTPS redirect happening via 302 instead of 301
- Redirect chain passing through HTTP intermediate URLs
- Browser briefly showing HTTP before landing on HTTPS
- Security scanners flagging insecure redirect chains
Causas comunes
- HTTP to HTTPS redirect configured as 302 (temporary) instead of 301 (permanent)
- Multi-hop redirects where one hop uses HTTP
- Load balancer redirecting to HTTP backend before HTTPS frontend
- CMS or application generating HTTP URLs in redirects
- HSTS not enabled to prevent initial HTTP request
Solución paso a paso
- 1
Check HTTP headers and redirects
Trace the full redirect chain from HTTP to final HTTPS destination.
Usar HTTP Headers → - 2
Test for open redirects
Check if your domain is vulnerable to open redirect attacks.
- 3
Fix redirect chain
Ensure all redirects go directly to HTTPS (no HTTP intermediate hops) using 301 status codes.
- 4
- 5
Verify SSL is valid
Confirm the HTTPS endpoint has a valid, trusted certificate.
Usar SSL Certificate Check →
Herramientas de diagnóstico recomendadas
Monitor Redirect Security
Track redirect chains and detect insecure hops.