Redirect from HTTP to HTTPS; SSLStrip

Question

Our web app home page redirects from HTTP to HTTPS. Our security consultant has told us this is a significant security weakness, that the redirect could be intercepted e.g. by SSLStrip. And therefore, we should remove the redirect, and disable HTTP entirely, requiring the user to manually type in https://...

Having studied the issue myself, it seems to me that the initial http response can be MITM faked by an attacker directly - no need for a redirect. So, removing the redirect achieves nothing.

I'm not sure though, if SSLStrip itself specifically can do this - maybe it needs to see the initial HTTP response first.

I understand that HSTS would prevent this problem, IF the device/browser in question has contacted our app once before. But for the initial contact, the HTTP request can be hijacked, regardless of what the app does - there is no protection, unless our web app were popular enough to be included in browser HSTS lists.

What did I miss? Is the redirect from HTTP to HTTPS significant?

I'm loathe to remove it as it will prevent many typical users from being able to connect to our site, and it doesn't seem to achieve anything.

Answer 1

Yes, in a MITM scenario, an initial HTTP request is all it takes to successfully attack (if the user doesn't notice the missing HTTPS). And the only way to prevent this initial HTTP request is HTTP Strict Transport Security (HSTS).

As you know, HSTS means that your server's HTTPS responses include a HSTS header telling the browser only to use HTTPS, i.e. the client doesn't know that he must only contact the server via HTTPS before he gets the first HTTPS response.

But there is a feature of HSTS that solves this problem: preloading! All browsers supporting HSTS, also include a hardcoded list of domains, that must only be contacted via HTTPS. Everybody can submit their domain to be included in the HSTS preload list if they meet the criteria:

1. Have a valid certificate.
2. Redirect all HTTP traffic to HTTPS—i.e. be HTTPS only.
3. Serve all subdomains over HTTPS, specifically including the www subdomain if a DNS record for that subdomain exists.
4. Serve an HSTS header on the base domain for HTTPS requests:
   • Expiry must be at least eighteen weeks (10886400 seconds).
   • The includeSubdomains token must be specified.
   • The preload token must be specified.
   • If you are serving an additional redirect from your HTTPS site, that redirect must still have the HSTS header (not the page it redirects to).

Disabling HTTP on your server doesn't improve your security: the user won't know it is disabled before his first request and therefore will still make his request via HTTP and allow the MITM to respond to the request – even if your server wouldn't have answered it.