Are web browsers automatically using HTTPS when available?

Question

Type xkcd.com in location bar, hit return -> https://xkcd.com.

But if I type http://xkcd.com instead, it does not change to HTTPS.

I've checked both URLs, and they're not using HSTS headers. I'm not using HTTPS Everywhere. (And in either case, I wouldn't have expected it to be so easily bypassed). I don't have the HTTPS site bookmarked - in fact I have the HTTP url bookmarked.

Iceweasel (Firefox-ish) 16.0.2. (I guess my updates are probably slightly screwed up).

How does this work? Do other browsers do it as well?

Answer 1

According to After updating to 14.0.1 Firefox will force https on websites. How do I fix?, this is due to auto-completion:

it is because of the autocomplete. Is there any way to fix this without disabling this feature though?

So far, I haven't read about any ways to change how the autofill URL is selected from history.

If you turn off urlbar.autofill, then Firefox 14 will behave like Firefox 13: (1) the drop-down of list of matches from your bookmarks and history will appear below the address bar, and (2) if you don't choose a match from the list but instead press Enter, Firefox will load http:// + what you typed (or if you typed separate words, it will run a search).

If you've previously visited the HTTPS version of the page, you will see this when typing "xkcd" into the address bar:

When hitting Enter at this stage, you will land on https://xkcd.com, just like you're experiencing.

You can also highlight the https://xkcd.com in the dropdown and hit Del. The URL will then be removed and will land on the HTTP version the next time.

Answer 2

The autofill is recalling a previous usage of the https URL in your history. To avoid this behaviour for just that URL remove it from the history but if you want to avoid this going forward for all URLs set the Boolean pref browser.urlbar.autoFill to false on the about:config page.

http://kb.mozillazine.org/about:config