W3cubDocs

/HTTP

Upgrade-Insecure-Requests

The HTTP Upgrade-Insecure-Requests request header sends a signal to the server expressing the client’s preference for an encrypted and authenticated response, and that it can successfully handle the upgrade-insecure-requests CSP directive.

Syntax

Upgrade-Insecure-Requests: 1

Examples

A client requests signals to the server that it supports the upgrade mechanisms of upgrade-insecure-requests:

GET / HTTP/1.1 
Host: example.com 
Upgrade-Insecure-Requests: 1

The server can now redirect to a secure version of the site. A Vary header can be used so that the site isn't served by caches to clients that don’t support the upgrade mechanism.

Location: https://example.com/ 
Vary: Upgrade-Insecure-Requests

Specifications

Specification Status Comment
Upgrade Insecure Requests
The definition of 'upgrade-insecure-requests' in that specification.
Candidate Recommendation Initial definition.

Browser compatibility

Feature Chrome Firefox Edge Internet Explorer Opera Safari
Basic Support 44 48.0 (No)1 (No) 31 ?
Feature Android Chrome for Android Edge mobile Firefox for Android IE mobile Opera Android iOS Safari
Basic Support ? 44 (No) 48.0 ? 31 ?

1. Under consideration for future release.

See also

© 2005–2017 Mozilla Developer Network and individual contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Upgrade-Insecure-Requests