Edge redirecting HTTP to HTTPS

Question

Starting Monday (Aug. 29, 2022) all our internal application websites that run over http are not getting redirected to https in Edge. I have checked if there were any policy changes in Intune or GPO and we cannot find any. Also, it started happening for just a few users but throughout the day more are having this happen. The setting in Edge to redirect from HTTP to HTTPS is not enabled by default, but we even tried manually disabling this and it still is doing it. I have a feeling it could be a Windows update but I tested installing all available updates on another PC and it does not have the issue yet. If the user opens the sites in an in private browser window they don't have the issue either. Any help or suggestions is appreciated.

Answer 1

Site redirection is generally a feature of the site you're going to. For example if you navigate to http://google.com the server will send back a 301/302 to redirect. Open the browser on a machine experiencing the issue and go to the site you expect. Bring up the Developer Tools (F12) and go to the network tab. Ctrl+F5 the page to reload it. In the network tab you should the request to http. In the response you should get back a 301/302 with the URL using https. If you don't then the site isn't doing redirection as it probably should. You can confirm this by going to a machine where it is redirecting and confirm the behavior.

If you want to force all sites to redirect then check the policy on the browser itself by navigating to edge://settings/privacy. However it is an experimental feature at least in 102 so you'll navigate to edge://flags/#edge-automatic-https instead. Note also that if you're using Edge's features to do smart navigation (or whatever they call it) then it is possible that your URL is getting matched to http sometimes and https others. Having sites auto-redirect is the correct solution to solve this.

Finally note that if the site was misconfigured with a redirect rule and that rule was permanent then you are in the tricky situation of having to get the browser to reset itself.

Answer 2

Thank you for your response. I agree with what you are saying, however we have tried manually disabling the settings in both edge://settings/privacy and edge://flags/#edge-automatic-https without success. The default values are supposed to be disabled anyway too from what I understand. These are all internal application sites that haven't changed in many years, and running various web servers (IIS, Apache, etc.) and for all of them to start having the behavior points me to something else than the web sites. Also the fact that some users can access it fine and others can't doesn't make sense. I'm leaning toward this is an issue with a recent Windows update rolling out as users have started to get them at the end of the month, but doesn't make sense that I forced my machine to get them and everything was still working. I've gone over any policy changes and didn't find any either.

Regardless the quickest fix I could find was to reconfigure as many of the sites as I could to use https, which is good practice anyway. Not sure if I can do that for all of them though.

Answer 3

Hi @CDA678

I agree with cooldadtx's answer. Http to https redirecting is not decided by browser. It's decided by sever client. But you can make redirection happen in browser even if it doesn't have a redirect rule in sever client.

You can enable Automatic HTTPS in edge://flags/#edge-automatic-https. Then enable Automatically switch to more secure connections with Automatic HTTPS in edge://settings/privacy and choose Always switch from HTTP to HTTPS (connection errors might occur more often). The site loading is also related with browser cache so you can clear browser cache and reload the site to test.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Regards,
Yu Zhou