minecraft.net language redirects use HTTP if no cookies are set
The bug
When a minecraft.net URL without language (e.g. en-us) as part of the URL path is used, e.g. https://www.minecraft.net/does-not-exist, and no cookie for www.minecraft.net is set, the redirect uses an HTTP (instead of HTTPS) URL as destination.
Reproduction steps
- In your browser delete all cookies for www.minecraft.net (or possibly even all *.minecraft.net cookies)
- Open the developer tools of the browser
- Open the tab for displaying network traffic
- Try opening https://www.minecraft.net/does-not-exist
- Look at the HTTP response
The Location header used for the redirect uses HTTP, e.g. http://www.minecraft.net/de-de/does-not-exist
2020-09-07, 12:11 AM
2022-12-06, 05:04 PM
2022-12-06, 05:04 PM
1
2