2

Let's imagine my main website is https://www.example.com, but a user types in http://www.example.com.

Should this redirect straight to https://www.example.com, or should it first redirect to https://example.com in order to cache the HSTS policy for the entire domain?

My HSTS policy is: max-age=31536000; includeSubDomains; preload

Does using preloaded HSTS change this at all?

1

If the browser is already "aware" of the HSTS policy for this domain, then the browser will immediately rewrite the request to go over HTTPS and will fail if that is not possible. There are two ways for a browser to become aware of an HSTS policy:

  1. Have previously visited the site with a valid HSTS policy, and recorded that HSTS visit.
  2. Having a preloaded HSTS policy from the site operator, such that the policy is included when the user downloads/updates the browser. Each browser has their own procedure for preloading HSTS.

So, if your policy is not in the preload list and your user has never visited your site before, then the first request may go over HTTP. (And, in the case of an active MITM, it may stay over HTTP since they can strip the HSTS header.)

Edit: includeSubdomains applies to the subdomains of the current domain being visited, and so a user visiting www.example.com will not get a policy for *.example.com, but *.www.example.com. If you want to apply the policy to all subdomains of your top level domain, you need to get the user there somehow. (This doesn't have to be a redirect, it could even be an IFRAME.) Per the RFC:

The OPTIONAL "includeSubDomains" directive is a valueless directive which, if present (i.e., it is "asserted"), signals the UA that the HSTS Policy applies to this HSTS Host as well as any subdomains of the host's domain name.

  • Thanks for your reply. The main thing I am asking is whether I need to redirect to the root domain in order to make sure that the HSTS policy is cached for the entire domain (example.com + *.example.com), rather than just for the subdomains (*.example.com). If the user never visits example.com, it won't cache the policy for there. – rubberband876 Feb 4 '18 at 0:05
  • Sorry, I misread your question initially. I've expanded my answer to talk more about that. – David Feb 4 '18 at 0:10
  • Thanks for your edit, but I think you misunderstood again. Additionally I have now realised my mistake in my previous comment regarding the *.example.com for includeSubDomains. What I am asking is whether I should be redirecting people to the root domain to cache the policy there. I obviously want the entire domain locked in with HSTS as that is the best security, rather than just the www. subdomain. Is this common practise or not? I know that the HSTS preload spec says that it should redirect to a secure version of the same host, for example hxxp://www -> hxxps://www. – rubberband876 Feb 4 '18 at 0:24
  • I think my edit answered exactly that: if you want to cache an HSTS policy for the top-level domain, you need to get your user to visit the top level domain. You can do that via a redirect, an iframe, etc. – David Feb 4 '18 at 0:34
  • I reason I am asking is because I seem to remember that when I first set up preloading on hstspreload.org, one of the requirements was to redirect away from hxxp://www back to the root domain over https in order to make sure the policy was cached. I have now rechecked this and it doesn't seem to be the case anymore. I just can't remember where I got this (incorrect?) information from. I know that preloading will preload the entire domain in the browser, it's just somewhere to do with preloading that I heard this info. Thanks – rubberband876 Feb 4 '18 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.