The HTTPUpgrade-Insecure-Requestsrequest header sends a signal to the server indicating the client's preference for an encrypted and authenticated response, and that the client can successfully handle theupgrade-insecure-requestsCSP directive.

Syntax

Upgrade-Insecure-Requests: <boolean>

Directives

<boolean>

1 indicates 'true' and is the only valid value for this field.

Examples

Using Upgrade-Insecure-Requests

A client's request signals to the server that it supports the upgrade mechanisms ofupgrade-insecure-requests:

GET / HTTP/1.1Host: example.comUpgrade-Insecure-Requests: 1

The server can now redirect to a secure version of the site. AVary header can be used so that the site isn't served by caches to clients that don't support the upgrade mechanism.

Location: https://example.com/Vary: Upgrade-Insecure-Requests

Specifications

Browser compatibility

See also

• Content-Security-Policy
• CSPupgrade-insecure-requests directive
• HTTP Caching: Vary andVary header