Very good point.<p>However, even if the attacker MITMs an HTTP request that would have been redirected, for a site that didn&#x27;t use HSTS, they won&#x27;t get cookies marked &quot;secure&quot;, and they won&#x27;t get permissions that require HTTPS.  So the browser mechanism limiting those permissions to HTTPS still works even in that case, though the user and site both have other problems.