Upgrade-Insecure-Requests
The HTTP Upgrade-Insecure-Requests
request header sends a signal to the server expressing the client's preference for an encrypted and authenticated response, and that it can successfully handle the upgrade-insecure-requests
CSP directive.
Header type | Request header |
---|---|
Forbidden header name | no |
Syntax
http
Upgrade-Insecure-Requests: 1
Examples
A client's request signals to the server that it supports the upgrade mechanisms of upgrade-insecure-requests
:
http
GET / HTTP/1.1
Host: example.com
Upgrade-Insecure-Requests: 1
The server can now redirect to a secure version of the site. A Vary
header can be used so that the site isn't served by caches to clients that don't support the upgrade mechanism.
http
Location: https://example.com/
Vary: Upgrade-Insecure-Requests
Specifications
Specification |
---|
Upgrade Insecure Requests # preference |
Browser compatibility
BCD tables only load in the browser
See also
Content-Security-Policy
- CSP
upgrade-insecure-requests
directive