I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP.
I'm not entirely certain for HSTS but I think so.
(The idea itself is sound. It is similar to what "Opportunistic Encryption" has in mind: make the attacker work harder by using at least some amount of crypto for at least some connections.)
The RFC's abstract says this:
This specification defines a mechanism enabling web sites to declare
themselves accessible only via secure connections and/or for users to
be able to direct their user agent(s) to interact with given sites
only over secure connections.
And the "and/or" bit of the sentence seems important here.
So what you can do via HSTS is declare something like: This site is HTTPS all the way. This site will work for you even if your firewall blocks all connections to port 80. And as an afterthought: Should there be a plain HTTP link left anywhere around here, then that's a mistake, please quietly upgrade that to HTTPS.
And this silent-upgrade-xor-failure bit would save you from a scenario they give here: (section 126.96.36.199)
Even if the site's developers carefully scrutinize their login page
for "mixed content", a single insecure embedding anywhere on the
overall site compromises the security of their login page because an
attacker can script (i.e., control) the login page by injecting code
(e.g., a script) into another, insecurely loaded, site page.
And while the server is expected to redirect the client to HTTPS (section 7.2):
If an HSTS Host receives an HTTP request message over a non-secure
transport, it SHOULD send an HTTP response message containing a
status code indicating a permanent redirect,
...this is a SHOULD and not a MUST.
So, in summary: yes, what you're asking should be both a possible and a legitimate use of HSTS.
Another thing: if you wish to support laptop users who may use both the HTTPS version of your site (e.g. from home) and the plain HTTP version of your site (e.g. from their office WIFI), then you will have to set the HSTS timeout low enough. (A few minutes maybe.)