2

Is it safer to use the preloading feature of HTTP Strict Transport Security (HSTS) and if so, why?

With preloading:

Strict-Transport-Security: max-age=10886400; includeSubDomains; preload

Without preloading

Strict-Transport-Security: max-age=10886400; includeSubDomains
|improve this question
  • 1
    It is only more secure if you enter your website in a preload list and the URL will be included in the browser database! Just adding "preload" to the header does nothing. You have to sign up at hstspreload.appspot.com – Josef Jul 12 '16 at 8:49
3

It is actually even safer.

Conventional HSTS only takes effect after the first request to the site, and until the user clears his browser's cache (each browser may handle this differently but I assume clearing all browsing data should also delete the HSTS list), and I believe HSTS does not persist between non-private and private browsing due to privacy concerns.

"Preloaded" HSTS works by telling everyone that you wish your HSTS header to be shipped with browser updates, so that browsers know your site should only be accesses using HTTPS even if your user never visited your site before. It has some implications of course, mainly not being able to opt-out (let's say you go back to HTTP, not only will your existing users not be able to connect because they saw your HSTS header, but new users won't either because the HSTS header is bundled with their browser).

I believe you also have to submit the site manually using Google's form as I don't think they crawl the internet looking for preload headers, at least not yet.

|improve this answer
  • Just appending the "preload" directive to the HSTS header should indeed not change how browsers treat your website -- the way I understand it, it's just how site owners consent to being on said list. The directive is not part of IETF's HSTS specification either (tools.ietf.org/html/rfc6797) – zinfandel Jul 11 '16 at 22:38
  • Yes, it is only more secure if you enter your website in a preload list and the URL will be included in the browser database! Just adding "preload" to the header does nothing. You have to sign up at hstspreload.appspot.com Also it takes time (months) until the url is included in new browser releases. Obviously, it also only increases security for users with up to date browser versions. – Josef Jul 12 '16 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.