Visiting http doesn't redirect to https about dotland

[rsp]

Good catch.

http://deno.land/ doesn't redirect to https and it also seems that neither do code URLs:

$ curl -i http://deno.land/x/dirname/mod.ts

(no redirect, just sending code over unencrypted HTTP)

But it has a Strict-Transport-Security header:

$ curl -i http://deno.land/x/dirname/mod.ts | grep Strict
Strict-Transport-Security: max-age=31536000

which is remembered by the browser and tells the browser to never access this website over HTTP. So from now on all HTTP requests to this domain are internally redirected by the browser to HTTPS and so in fact the HTTP request is not going out to the network but only HTTPS (unlike a normal redirect when the browser makes a request, the server gets it and sends a response with a Location header and a redirect status code).

I don't know if this is a desired behavior to support user agents that don't understand HTTPS, or is it just a oversight.

[ry]

Fixed