2

I'm reasearching the strict-transport-security protocol, and am writing a plugin for Firefox to highlight some of the issues with the protocol. One of the things that i'm looking at is mixed content.

If the site is using HSTS, and the page contains a link to a HTTP link (a mixed content link), then surly this isn't an issue, as the site when retrieving the content will do so over HTTPS, and not HTTP?

Clarification would be good!

Thanks,

2

If:

1) Your browser supports HSTS

2) You load a page at https://www.example.com/ in the browser

3) The page at https://www.example.com/ contains a valid HSTS Strict-Transport-Security header

Then:

Any subsequent request to www.example.com will be done over HTTPS, as per the HSTS Strict-Transport-Security header.

So, if the page at https://www.example.com/ contains a reference to some resource at http://www.example.com/someresource, then the browser will request the resource at www.example.com/someresource via HTTPS instead of HTTP, as per the HSTS Strict-Transport-Security header.

2

Only if the mixed content is on the same domain.

If the HSTS policy is on https://example.com and this loads an image from http://example.org then mixed content will show.

If however, the plain HTTP image is loaded from http://example.com then the browser will upgrade the HTTP connection to HTTPS so there will not be mixed content on the page.

  • In your first example, would this result in completely denying the visit due to it not being fully secure? – Tim Malone Oct 28 '16 at 21:27
  • No, an image isn't "active" content like eg. script. The browser will warn about mixed content but will still show the page and the image. – SilverlightFox Oct 28 '16 at 21:30
  • Thanks. And in the case of active content, it would just refuse to load that content? – Tim Malone Oct 28 '16 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.