Firefox Tomorrow

http header

Upgrade-Insecure-Requests header

View on MDN ↗

The HTTP Upgrade-Insecure-Requests request header sends a signal to the server indicating the client’s preference for an encrypted and authenticated response, and that the client can successfully handle the upgrade-insecure-requests CSP directive.

Header type [Request header](https://developer.mozilla.org/en-US/docs/Glossary/Request%20header)
[Forbidden request header](https://developer.mozilla.org/en-US/docs/Glossary/Forbidden%20request%20header) No

Syntax

Upgrade-Insecure-Requests: <boolean>

Directives

  • <boolean>
    • : 1 indicates ‘true’ and is the only valid value for this field.

Examples

Using Upgrade-Insecure-Requests

A client’s request signals to the server that it supports the upgrade mechanisms of upgrade-insecure-requests:

GET / HTTP/1.1
Host: example.com
Upgrade-Insecure-Requests: 1

The server can now redirect to a secure version of the site. A Vary header can be used so that the site isn’t served by caches to clients that don’t support the upgrade mechanism.

Location: https://example.com/
Vary: Upgrade-Insecure-Requests

Specifications

SpecificationsStandards references are available on the canonical MDN page.

Browser compatibility

Browser compatibilityCompatibility data is available on the canonical MDN page.

See also