52

Safari forces a redirect to the https version of a site I previously visited via https.

However, the https site no longer works and there is no way to prevent Safari form trying to load it.

HTTP redirects to HTTPS

Here is a related Apple Forums question, Safari keeps redirecting http to https

2
35
+50

If the site has previously indicated to Safari that it wishes to always be accessed over HTTPS through HSTS (HTTP Strict Transport Security), then Safari will always try to redirect to HTTPS.

You can clear the HSTS cache by deleting ~/Library/Cookies/HSTS.plist.

Note that Safari does also cache 301 redirects for a while and thus clearing the normal Safari cache may also be necessary: from the Develop menu (enable in Preferences → Advanced), choose Empty Caches.

#For 2020...

In current MacOS, you must

  1. Clear the cache in Safari. (Developer menu.) Then immediately:
  2. Quit Safari, and any other apps that may use networking (quit all apps)
  3. Open /Users/ your user name /Library/Cookies which will look like:

enter image description here

  1. Throw HSTS.plist in the trash, then immediately restart the whole Mac.

In extreme cases, turn off all bandwidth to the Mac before steps 1-2-3-4.

In current MacOS, the HSTS list is immediately rebuilt if the file is thrown away, if any networking happens. Hence the Mac needs an immediate restart for trashing to work.

8
  • I should start writing answers...
    – bot47
    Nov 12 '15 at 5:46
  • 14
    @grgarside I tried this multiple times, it's not working anymore
    – kushdilip
    Nov 7 '16 at 11:43
  • "Clearing the normal Safari cache" — how, exactly??
    – Wildcard
    Apr 11 '17 at 20:41
  • 1
    @grg , thanks a million for your great answer from 5 yrs back! There is a new bit of info. I actually edited it in to your answer - obviously, revert or change as you wish!! Thanks again
    – Fattie
    Apr 16 '20 at 12:23
  • 1
    @Fattie: it worked the 2nd try, I also needed to clear the regular cache (now in the Developer menu)
    – juggleware
    Jan 12 '21 at 19:00
27

HSTS Policy is now included in Safari's stored website data, and you can remove localhost data to clear this issue.

  1. command + ,
  2. Privacy -> Manage Website Data...
  3. Search localhost
  4. Click Remove

Change https://localhost to http://localhost in your address bar and click return key.

1
  • 4
    This applies not only to localhost, but to any domains. Note, that in order to access subdomain, you have to remove parent domain's data. I.e. if you want to access http://some.subdomain.somehost.com and get redirected to https, you have to search for somehost.com at the Manage Website Data page and remove it.
    – voiger
    Oct 30 '19 at 15:50
11

Since December 2017, Google has added ".dev" TLD to the preloaded HSTS list for Chrome!

Safari uses the same list. So Safari will always add *.dev to HSTS list...

Seems many developers will need to change .dev suffix to another one :(

See: Chrome to force .dev domains to HTTPS via preloaded HSTS

2
  • 3
    This incites my rage. No TLD should be wholly ownable. There are wonderful things called VPNs or Intranets that would be appropriate. (P.S. my rage is directed at Google, not the answer) :).
    – Volte
    Feb 20 '18 at 20:48
  • Lol, my suffix is .dev. Here I am wondering why it works in Postman and not in the browser -_-
    – pavlee
    May 1 '21 at 21:28
9

I haven't found any working solution but for a workaround use 127.0.0.1 instead of localhost

http://localhost/

http://127.0.0.1/
2
  • Super! Thanks for sharing that.
    – Mohsen
    May 18 '20 at 7:44
  • Thanks. Worked for me. Aug 20 '20 at 11:15
1

It seems Safari enters into this mad behaviour when you have accessed localhost using a client side certificate. In my case, one of the projects I work with needs this client side setup and it totally wrecks development for the projects where I can't use http on localhost. The only workaround I have found is to edit /etc/hosts and add an alias for localhost, like so

127.0.0.1 localhost

Then use I can use http://localhost:3000 to access my project on port 3000 without Safari forcing a https connection.

1

I also encountered this 'Safari HSTS Cache' problem.

I tried the sulution 'rm ~/Library/Cookies/HSTS.plist', but it does not work.

But the following step is useful:

  1. Quit Safari
  2. killall nsurlstoraged, to stop HTTP storage manager ( because it has an in-memory cache of the HSTS hosts)
  3. rm -f ~/Library/Cookies/HSTS.plist, remove HSTS cache file
  4. launchctl start /System/Library/LaunchAgents/com.apple.nsurlstoraged.plist, restart nsurlstoraged again

The most important is, service nsurlstoraged has a in-memory HSTS cache, must reload this service.

3
  • Step #4 is not really required because launchctl will automatically restart nsurlstoraged since the service is loaded. Also, the command you gave is wrong because launchctl start only accepts service name, not path to service plist. So it should be launchctl start com.apple.nsurlstoraged.
    – Joy Jin
    Oct 26 '21 at 13:17
  • Thanks for your answer.
    – gengsa
    Oct 29 '21 at 5:15
  • I can't see any edit of your answer. Do you mind if I edit your answer?
    – Joy Jin
    Oct 30 '21 at 3:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .