HRESULT 0x80072F08 (WININET_E_HTTPS_TO_HTTP_ON

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

A redirect request will change a secure to a non-secure connection

Previous	Next
WININET_E_HTTP_TO_HTTPS_ON_REDIR	WININET_E_MIXED_SECURITY

WININET_E_HTTPS_TO_HTTP_ON_REDIR

WININET_E_HTTPS_TO_HTTP_ON_REDIR reports a redirect that would downgrade a request from HTTPS to HTTP. It is not merely a navigation detail: a later request could expose cookies, credentials, form data, or response expectations on an unencrypted connection.

What to do

Inspect the Location target and the redirect status before accepting it.
Apply a policy that rejects downgrade redirects for authenticated or sensitive operations.
Check whether a proxy, captive portal, or misconfigured origin is producing the redirect.

Avoid a global bypass

WinINet exposes flags that affect redirect behavior, but allowing all HTTPS-to-HTTP redirects weakens the security model for every request using the handle. Prefer an explicit allow-list only where a legacy requirement is understood.

Microsoft: InternetErrorDlg redirect handling · Microsoft: HttpOpenRequest flags

Looking for a different code? Search another status or error code.