Connection upgrades in Waterfox

Waterfox tries to use HTTPS instead of unencrypted HTTP whenever a secure connection is available. This protects data in transit and helps prevent other parties on the network from reading or changing it. An older link can still begin with http:// even when the site supports HTTPS, so Waterfox may upgrade the connection before loading the page.

What is the difference between HTTP and HTTPS?

HTTP defines how browsers and web servers exchange data. HTTP does not encrypt the connection, so data can be observed or altered in transit. HTTPS uses Transport Layer Security (TLS) to authenticate the server and encrypt the connection.

Connection upgrade mechanisms

An upgrade can be initiated by a web server or by Waterfox. The mechanism also depends on whether the request is for the main page or for a resource used by that page.

Server-initiated upgrades

A server can indicate that it supports HTTPS in several ways:

• HTTP Strict Transport Security (HSTS) tells Waterfox to use secure connections for a site. Waterfox remembers the instruction, and it also includes an HSTS preload list for selected sites.
• HTTPS Resource Records (HTTPS RR) are DNS records that advertise secure connection details.
• A website can redirect an HTTP request to HTTPS with a status such as 301 Moved Permanently.

Waterfox-initiated upgrades

Waterfox supports two related upgrade modes:

• HTTPS-First is enabled by default for eligible top-level requests. Waterfox tries HTTPS first and can fall back to HTTP if the secure connection fails.
• HTTPS-Only Mode is an optional stricter setting. It prevents Waterfox from loading an insecure connection without first warning you. Sites that are available only over HTTP can therefore require an extra confirmation.

Browser extensions can also upgrade requests for specialized use cases.

Page resources

The mechanisms above mainly describe top-level navigations, such as entering an address or selecting a link. Pages also request images, scripts and other resources.

• A site’s Content Security Policy can use the upgrade-insecure-requests directive to upgrade insecure resources.
• The browser’s mixed content rules upgrade or block insecure resources used by a secure page.
• HTTPS-Only Mode also applies protections to page resources.

---