I was watching the following presentation:
It addressed the issue when trying to access a particular web site that is available over both HTTP and HTTS and that the initial request will be send via HTTP hence exposing cookies to eavesdropping /MiTM attacks and how HSTS can address this type of issues.
The ultimate solution would be to have ALL content to be served via HTTPS so that no packet exchange is made via HTTP at all, or will it not block it?
But for HSTS to work in a mixed HTTP/HTTPS scenario each page that I’m requesting (the browser will default to HTTP) will have to be available via HTTPS as well, right ? If it’s not, HSTS will not allow to make an HTTP connection at all?
Also if you look at 8:22 in the movie there’s an illustration of the process while accessing a site (google.com in his example) where a cookie is sent with the first GET request via HTTP, could someone please verify:
a) This would only happen if the web site is available vi HTTP and HTTPS and a redirect is sent upon the initial GET request from client and where HSTS is not in place (and I have a cookie for that web site already on my laptop), right ? b) In a scenario where I’m accessing the same page for the very first time from a different computer even without HSTS enabled , there’s no risk because I don’t have a cookie from the web server yet, so no cookie will be sent with the initial HTTP GET request, correct ? c) Quoting from https://news.netcraft.com/archives/2016/03/17/95-of-https-servers-vulnerable-to-trivial-mitm-attacks.html
Because HSTS directives are delivered via an HTTP header (over an HTTPS connection), HSTS can only instruct a browser to only use HTTPS after the browser's first visit to a secure website.>
But wouldn’t this create a door for MiTM attacks and cookie hijacking in case ONLY when the web server does not send a redirect to the client but continues via HTTP? I mean in the initial client GET HTTP request we’re not sending any cookie, the server sends it, so wouldn’t the web server send it via HTTPS to the client ?