HTTP/1.1 Upgrade header

Use with TLS

One use is to begin a request on the normal HTTP port but switch to Transport Layer Security (TLS) as described in RFC 2817. In practice such use is rare, with HTTPS being a far more common way to initiate encrypted HTTP.

The server returns a 426 status code to alert legacy clients that the failure was client-related (400 level codes indicate a client failure).

This method for establishing a secure connection is advantageous because it:

• Does not require messy and problematic URL redirection on the server side;
• Enables virtual hosting of secured websites (although HTTPS also allows this using Server Name Indication); and
• Reduces the potential for user confusion by providing a single way to access a particular resource.

If the same resources are available from the server via both encrypted secure means and unencrypted clear means, a man-in-the-middle may maintain an unencrypted and unauthenticated connection with the client while maintaining an encrypted connection with the server.

Disadvantages of this method include:

• The client cannot specify the requirement for a secure HTTP in the URI (though the client can require such via the upgrade negotiation); and
• Since HTTP is defined on a hop basis, HTTP tunneling may be required to bypass proxy servers.