EXERCISE 2 — The redirect gap, and how HSTS closes it
======================================================

THE GAP A PLAIN REDIRECT LEAVES OPEN:
  - With only an HTTP->HTTPS redirect, the user's FIRST request to the site
    still goes out over plain HTTP (e.g. they type "example.com" or click an
    http:// link). The server replies with 301 -> https://...
  - But that first HTTP request/response travels IN THE CLEAR. An active
    man-in-the-middle can intercept it BEFORE the redirect takes effect and
    simply never let the user reach HTTPS — serving them a plaintext (or
    attacker-controlled) version of the site instead. This is an
    SSL-STRIPPING attack (Chapter 11): the victim stays on HTTP and never
    sees a certificate warning, because no HTTPS was ever attempted from
    their side.
  - So a redirect protects users who reach HTTPS, but the vulnerable
    initial plaintext hop is exactly where stripping happens.

HOW HSTS CLOSES IT:
  - HSTS is a header sent OVER HTTPS:
        Strict-Transport-Security: max-age=31536000; includeSubDomains
  - Once a browser has seen it, the browser itself UPGRADES every future
    request to the domain to HTTPS internally, before anything goes on the
    wire. The user typing "example.com" or clicking an http:// link results
    in the browser making an HTTPS request directly -- no plaintext hop, no
    redirect to strip. The attacker has nothing to intercept.
  - It also makes cert errors UNBYPASSABLE for the domain (no clickthrough),
    so a MITM presenting a bad cert is hard-failed.

WHY HSTS ONLY PROTECTS *AFTER* THE FIRST SECURE VISIT:
  - The browser only knows the policy once it has actually RECEIVED the HSTS
    header, which can only arrive over a successful HTTPS connection.
  - So a brand-new visitor who has never connected securely (cleared cache,
    new device) still makes that one initial unprotected request -- the
    "trust on first use" gap. HSTS shrinks the window to a single first
    contact, but can't protect a visit that happens before it's ever seen.

WHAT THE PRELOAD LIST DOES ABOUT THE FIRST-VISIT GAP:
  - The HSTS PRELOAD LIST is a set of domains HARDCODED into browsers (via
    Chromium's list, shared by major browsers) as HTTPS-only.
  - For a preloaded domain, the browser treats it as HSTS-protected from the
    VERY FIRST request -- even if it has never connected before -- closing
    the trust-on-first-use gap entirely.
  - You opt in by adding the `preload` directive and submitting at
    hstspreload.org. Caveat: it's near-permanent and slow to remove, so only
    preload once HTTPS is rock-solid across the whole domain + subdomains.