HTTP Connections to Custom Domains Are Rejected Instead of Redirected

A penetration test may report that HTTP connections to a custom domain are rejected instead of being redirected to HTTPS. This article explains this intended security behavior.

• Custom Domains

Auth0's infrastructure is intentionally configured to explicitly reject insecure HTTP connections at the network edge. This design ensures that no application data, login forms, or credentials are ever transmitted over an unencrypted connection.

Instead of a standard redirect, the server returns an HTTP/1.1 426 Upgrade Required status code. This immediately blocks the insecure connection and instructs the client to upgrade to a secure connection using Transport Layer Security (TLS). This mitigates the man-in-the-middle risks associated with transmitting any data over HTTP, even as part of a redirection process.

The reported behavior is an intentional security best practice. To verify this behavior, perform the following steps:

1. Enter the following command in a terminal, replacing <your-custom-domain> with the relevant domain name:

curl -v http://<your-custom-domain>

2. Alternatively, go to the HTTP version of the custom domain in a web browser (for example, http://<your-custom-domain>).

Observe the server response. It includes the status code HTTP/1.1 426 Upgrade Required and a message confirming that the insecure connection is rejected:

• Beginning 2024-10-07, all connections to the Auth0 APIs must use TLS 1.2 or higher... You are currently using plaintext http to connect.

Additionally, the service includes the HTTP Strict Transport Security (HSTS) header in responses from the HTTPS endpoint. This security feature ensures that browsers that have successfully connected once no longer attempt insecure connections, aligning with the recommendations often found in penetration test reports.