So redirecting all port 80 requests to https://<domain>/ (or otherwise kill port 80 on the server).
Then, make sure each page view overwrites / clears any side-effecting session state.
Put another way, why should unexpected cookies change the side effects of post requests?
Anyway, if the browser is connecting via port 80, the MITM can just use a transparent http->https proxy to rewrite the referrer, and forward the request to the https server, so you've already lost.
Then, make sure each page view overwrites / clears any side-effecting session state.
Put another way, why should unexpected cookies change the side effects of post requests?
Anyway, if the browser is connecting via port 80, the MITM can just use a transparent http->https proxy to rewrite the referrer, and forward the request to the https server, so you've already lost.