If I open my FF developer tools, and look at the network tab, then enter http://mywebsite.com, there would be a 301 moved permanently to the https website as the first network request. If you do that to http://facebook.com, then the first request would be 200 with a request URL of https://facebook.com.
However, if you run a curl -I on both websites, the same result of 301 moved permanently would show. How do they do that?
I am using nginx that redirects to HTTPS behind Amazon ELB.
I think this is an effect of HSTS: HTTP Strict Transport Security
On the facebook responses headers you have this:
Strict-Transport-Security: max-age=15552000; preload
This tells your browser to memorize this HTTP to HTTPS redirection for this domain for a big amount of time, without trying a real HTTP connection to get the 301.
And if you think that having something in your browser which is stored in memory and affects the way the first requests are made on some already visited domains, even after a browser close, could have some privacy impact, well... you would be right.
