title: Is redirecting http to https a bad idea?
body: <p>I'm reading over <a href="http://ferruh.mavituna.com/ssl-implementation-security-faq-oku/#_Toc198392036" rel="noreferrer">this page</a> and it says that if a site is SSL and the user tries to access it via regular http, the application should not redirect the user to https. It should just block him. Can someone verify the validity of this? It doesn't sound like a good idea, and I wonder what the real risk is of just forwarding the user to https. It seems that there is no technical reasons behind it, just that it's a good way to educate the user. </p>
  
  <blockquote>
    <p>Disable HTTP access to the domain,
    don’t even redirect or link it to SSL.
    Just inform the users this website is
    not accessible over HTTP and they have
    to access it over SSL.</p>
    
    <p>This is the best practice against MITM
    and phising attacks. This way your
    users will be educated that
    application never accessible over HTTP
    and when they come across to a phising
    or MITM attack they will know
    something is wrong.</p>
    
    <p>One of the best ways to protect your
    application against MITM attacks and
    phising attacks is educating your
    users.</p>
  </blockquote>