Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
1

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)

Also does HSTS make even the resources like CSS, images to be used HTTPS or just when the content type is text/html ?

share|improve this question

2 Answers

up vote 5 down vote accepted

Yes, if you are using SSL sitewide, then I definitely recommend enabling HSTS.

HSTS is an important security measure to defeat man-in-the-middle attacks that shift the user over to http and then attack the user. For instance, sslstrip is a well-known tool to mount such an attack. For more details on this sort of attack, see the following questions: How to thwart sslstrip attack?, Options when defending against SSLstrip?, and this answer.

HSTS tells the browser: never use HTTP with this site. Only access it via HTTPS. So, to enable HSTS, you must make sure that your site works with HTTPS, and only HTTPS. This includes everything: HTML, CSS, Javascript, everything. Make sure all of the CSS and Javascript on your site is available over HTTPS. Also, I suggest that you convert your pages to reference everything over HTTPS (I recommend your pages avoid loading any other Javascript or CSS resource over HTTP, as that may cause warnings or security problems for some browsers).

For instance, let's say your site is www.example.com and you have a page https://www.example.com/buy.html which includes some Javascript from your site. You must make sure you your Javascript file is available on a HTTPS URL (e.g., https://www.example.com/library.js). I recommend that you load it via a HTTPS URL (e.g., <SCRIPT SRC="https://www.example.com/library.js">).

P.S. I also recommend that you set the secure flag on all cookies you use.

share|improve this answer
up vote 9 down vote

Yes, strict transport security provides a real benefit.

HSTS tells the browser to only communicate with the server via HTTPS. The first time the browser sees the HSTS header from the server, it remembers it. When the user visits the site again, the browser enforces that all communication is done via HTTPS. This will work as long as the attacker doesn't strip the header on the first visit to the site.

This prevents SSL-stripping attacks, a form of man-in-the-middle attack which presents the user with a clear-text resource instead of the SSL one. Normally, the user would not be alerted, and most "average" users wouldn't spot that the SSL padlock or green/blue highlight isn't shown in the URL bar. In the case of HSTS, the browser would immediately warn the user that the browser is attempting to violate its own security policy.

  1. Client creates a clear-text connection to the server.
  2. Server responds with a redirect to the HTTPS address, with the HSTS header set.
  3. Client and server communicate over SSL.
  4. Session ends.
  5. Client comes back later, browser has stored the HSTS flag for this domain.
  6. Attacker attempts to perform SSL-strip attack, and serves clear-text to the client.
  7. Client recognises that the HSTS policy disallows this, and alerts the user.

For further security, some are proposing that HSTS be implemented as an option in DNSSEC, so that the HSTS header is set as part of the DNS lookup. Since DNSSEC provides strong security through pre-distributed authority certificates, this would make it exceedingly difficult for an attacker to defeat the HSTS mechanism, even if they are actively attempting to SSL-strip on the first visit to the site.

share|improve this answer
if my webserver only goes for HTTPS then how MiTM possible ? – Novice User Jul 16 '12 at 16:05
1  
@NoviceUser An attacker can use a variety of techniques (e.g. poison routing) to hijack the TCP connection, then pretend to be the server. He can't pretend to be the server in SSL mode, because he would need the server's private key, so he sends a downgrade header that causes the browser to switch back to HTTP. The browser then talks to the attacker in plaintext, and the attacker talks to the server via SSL, as if it were a legitimate client. The client doesn't see the "secure" padlock on their browser, but most people don't notice. – Polynomial Jul 16 '12 at 16:09
@Polynomial this assumes though that the MiTM isn't in the middle during the initial connection that returns the header. If so then the attacker could just strip the header and the browser would never see it. – SteveS Jul 16 '12 at 19:07
@SteveS I covered that. Last sentence of the first paragraph: "This will work as long as the attacker doesn't strip the header on the first visit to the site.", and the latter part of the last sentence: "this would make it exceedingly difficult for an attacker to defeat the HSTS mechanism, even if they are actively attempting to SSL-strip on the first visit to the site." – Polynomial Jul 16 '12 at 19:21
@Polynomial oops. So you did. Sorry. :) – SteveS Jul 16 '12 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.