| Previous | Next |
| WININET_E_HTTP_TO_HTTPS_ON_REDIR | WININET_E_MIXED_SECURITY |
WININET_E_HTTPS_TO_HTTP_ON_REDIR
WININET_E_HTTPS_TO_HTTP_ON_REDIR reports a redirect that would downgrade a request from HTTPS to HTTP. It is not merely a navigation detail: a later request could expose cookies, credentials, form data, or response expectations on an unencrypted connection.
What to do
- Inspect the
Locationtarget and the redirect status before accepting it. - Apply a policy that rejects downgrade redirects for authenticated or sensitive operations.
- Check whether a proxy, captive portal, or misconfigured origin is producing the redirect.
Avoid a global bypass
WinINet exposes flags that affect redirect behavior, but allowing all HTTPS-to-HTTP redirects weakens the security model for every request using the handle. Prefer an explicit allow-list only where a legacy requirement is understood.
Microsoft: InternetErrorDlg redirect handling · Microsoft: HttpOpenRequest flags
Looking for a different code? Search another status or error code.