400: The Plain Http Request Was Sent To Https Port

This topic delves into the intricacies of online security and protection, examining the vulnerabilities exposed when a user sends an HTTP request over a secure connection like HTTPS. In this article, we'll delve into the specifics of how Cloudflare functions and why this phenomenon occurs.

When a user initiates an HTTPS connection to a server, their browser sends a plain HTTP request to the HTTPS port (443 in this case). This might seem harmless at first glance, but it reveals a critical security oversight.
Most modern web browsers are configured to automatically redirect HTTP traffic to HTTPS. However, when the same user attempts to send an HTTP request over a secure connection, the browser may not recognize the difference and attempt to use the regular port (80 in this case). This can lead to unexpected behavior and security risks.
Certain security protocols, such as TLS (Transport Layer Security) and DTLS (Datagram Transport Layer Security), operate on top of HTTPS. These protocols rely on the underlying TCP/IP stack being configured to use the correct ports, which may not always be the case.

So, what can you do to mitigate this issue? One solution is to configure your browser or server to explicitly redirect HTTP traffic to HTTPS when possible. Another approach is to implement a custom proxy or reverse proxy setup that can detect and modify the request accordingly.

400: The Plain Http Request Was Sent To Https Port

Suggested Reading