The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
286 views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
1
vote
1answer
101 views

Checking domains HSTS status

The Chrome browser offers a quick way to check domains HSTS status over the page chrome://net-internals/#hsts (section query domain). The query result looks e.g. like this: Found: domain: owasp.org ...
1
vote
1answer
44 views

How can non-secure or non-https-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and https-only and remaining 5 are neither. In this scenario, in what all ways can we ...
0
votes
1answer
109 views

True or False: HSTS is absolutely useless against MITM attacks

I do understand that it is a good security measure to implement HSTS, because it will reduce the number of incidents. Statement 1: If clients IO traffic goes through MITM from the start, can the ...
6
votes
2answers
147 views

HSTS behaviour within incognito mode?

By definition, incognito mode shouldn't leave a trail of visited websites. However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, ...
2
votes
1answer
531 views

Can HSTS be defeated?

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site ...
1
vote
2answers
83 views

HTTP Header disabling non-SSL (or TLS) content on this page

Is there an HTTP Response header that disallows any non-SSL content from being displayed on the current page? The idea is some times external content that needs to be on the website (cough, ad ...
1
vote
2answers
135 views

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
2
votes
2answers
962 views

Why doesn't Facebook use HSTS

To force a browser to always use HTTPS for a website (and not rely on 302 redirects to visit the HTTPS version), HTTP Strict Transport Security can be used. Please refer to ...
1
vote
1answer
101 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
2
votes
1answer
249 views

Caching Behaviour on major browsers

Before I even ask the question - this is a hard question to frame, so I welcome edits to improve clarity. How do major browsers decide how to cache responses, especially if said responses are ...
15
votes
2answers
743 views

Twitter's HTTP response vs Google's HTTP response

I was looking at the HTTP responses form https://twitter.com and https://encrypted.google.com. These two responses have interesting similarities and differences in their security definitions. Both ...
3
votes
2answers
779 views

Is there a problem with issuing a HSTS header in PHP?

I want to trial a HSTS policy on my blog without enabling it site wide initially. As a HSTS policy is just a HTTP response header would there be any problem with sending the header in PHP like so: ...
4
votes
1answer
753 views

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
20
votes
4answers
919 views

How can a web application protect IE users when this browser doesn't support HSTS?

HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. My ...