Strict-transport-security Mixed Content - same domain?

Question

I'm researching the HTTPS-strict-transport-security protocol (HSTS), and am writing a plugin for Firefox to highlight some of the issues with the protocol. One of the things that I'm looking at is mixed content.

If the site is using HSTS, and the page contains a link to another page on the same site but over HTTP (a mixed content link), then surly this isn't an issue, as the site when retrieving the content will do so over HTTPS, and not HTTP?

Clarification would be good!

Answer 1

Only if the mixed content is on the same domain.

If the HSTS policy is on https://example.com and this loads an image from http://example.org then mixed content will show.

If however, the plain HTTP image is loaded from http://example.com then the browser will upgrade the HTTP connection to HTTPS so there will not be mixed content on the page.

Answer 2

If:

1) Your browser supports HSTS

2) You load a page at https://www.example.com/ in the browser

3) The page at https://www.example.com/ contains a valid HSTS Strict-Transport-Security header

Then:

Any subsequent request to www.example.com will be done over HTTPS, as per the HSTS Strict-Transport-Security header.

So, if the page at https://www.example.com/ contains a reference to some resource at http://www.example.com/someresource, then the browser will request the resource at www.example.com/someresource via HTTPS instead of HTTP, as per the HSTS Strict-Transport-Security header.