The suggestion may exist because it's possible to do nasty things if a user (particularly a logged-in user) goes to your http address.
If you don't have cookies configured to use https only (you don't), an attacker can grab a user's cookies. They can also intercept your redirect and send users to another site (see sslstrip).
I don't understand what you're talking about. My entire site is HTTPS, I also use Strict-Transport-Security, have a ruleset in HTTPS-Everywhere, and I don't use cookies at all. If I were to use cookies, I'd make sure to add the secure and httpOnly flags.
Me putting a redirect on http to https is no less secure than not providing http at all.
Comments
"Error generating report for https://grepular.com/ - Could not resolve address"
Is this due to HTTPS? This site really should support HTTPS...
EDIT: If I enter "http://grepular.com/ instead, it works. That URL simply redirects to the HTTPS version...
EDIT2: The only listed "problem" for my site is:
Don't think I'll be doing that thanks ;)The suggestion may exist because it's possible to do nasty things if a user (particularly a logged-in user) goes to your http address.
If you don't have cookies configured to use https only (you don't), an attacker can grab a user's cookies. They can also intercept your redirect and send users to another site (see sslstrip).
I don't understand what you're talking about. My entire site is HTTPS, I also use Strict-Transport-Security, have a ruleset in HTTPS-Everywhere, and I don't use cookies at all. If I were to use cookies, I'd make sure to add the secure and httpOnly flags.
Me putting a redirect on http to https is no less secure than not providing http at all.