I sent the session over http and it worked. It also worked for anyone sniffing the wire. TLS encrypts the channel and signs the origin, so the transport is part of the contract.
About 1 min of reading
Force the upgrade and read the HSTS header.
Request http and see the redirect to https, not a served page.
Before you run it, say out loud what it will print. Then open the answer.
The HSTS header tells the browser to stay on https for a year.
Before you run it, say out loud what it will print. Then open the answer.
A secure app over http is still insecure: the cookie and the body ride in the clear. TLS is not decoration, it is the reason the channel is private and the origin is real. Every state-changing route must be https-only.
HSTS tells the browser to request https for this host even before you redirect, so a mistyped http link or a stale bookmark cannot send a plain request. It closes the window the redirect alone leaves open.
http://yoursite/change <- bytes travel in the clearOver http the whole request, cookie included, is readable by anyone on the wire, a proxy, or a log. TLS is what makes it private.
https -> encrypted channel + verified originTLS encrypts the bytes so a eavesdropper cannot read them, and it binds the bytes to the domain, so a fake site cannot impersonate you.
http -> 307 -> httpsSend a permanent redirect from http to https and add HSTS so the browser upgrades before it ever sends a request. Never downgrade.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.