この記事はまだボランティアによって 日本語 に翻訳されていません。ぜひ MDN に参加して翻訳を手伝ってください！
この記事を English (US) で読むこともできます。
The HTTP Upgrade-Insecure-Requests request header sends a signal to the server expressing the client’s preference for an encrypted and authenticated response, and that it can successfully handle the upgrade-insecure-requests CSP directive.
| Header type | Request header |
|---|---|
| Forbidden header name | no |
Syntax
Upgrade-Insecure-Requests: 1
Examples
A client requests signals to the server that it supports the upgrade mechanisms of upgrade-insecure-requests:
GET / HTTP/1.1 Host: example.com Upgrade-Insecure-Requests: 1
The server can now redirect to a secure version of the site. A Vary header can be used so that the site isn't served by caches to clients that don’t support the upgrade mechanism.
Location: https://example.com/ Vary: Upgrade-Insecure-Requests
Specifications
| Specification | Status | Comment |
|---|---|---|
| Upgrade Insecure Requests The definition of 'upgrade-insecure-requests' in that specification. |
Candidate Recommendation | Initial definition. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
| Desktop | Mobile | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | Android webview | Chrome for Android | Edge Mobile | Firefox for Android | Opera for Android | iOS Safari | Samsung Internet | |
| Basic support | Chrome Full support 44 | Edge Full support 17 | Firefox Full support 48 | IE No support No | Opera Full support 31 | Safari Full support 10.1 | WebView Android ? | Chrome Android Full support 44 | Edge Mobile No support No | Firefox Android Full support 48 | Opera Android Full support 31 | Safari iOS Full support 10.3 | Samsung Internet Android Full support 4.0 |
Legend
- Full support
- Full support
- No support
- No support
- Compatibility unknown
- Compatibility unknown
See also
Content-Security-Policy- CSP
upgrade-insecure-requestsdirective