I know HSTS redirects HTTP requests to HTTPS for the target domain, or it helps in restricting downgrading HTTPS to HTTP. But I don't get the basic idea behind HSTS. I have gone through various tutorials, plus the OWASP Cheat Sheet on HSTS.

  • 2
    You might have to further explain what you do not understand else all you will get is people repeating what is in official documentation – schroeder Jul 13 '18 at 13:23

I assume that you understand the benefits of HTTPS over HTTP.

HSTS provides a means to tell clients to always use HTTPS when interacting with a site.

There are 2 ways a client can find out if it should only use HTTPS to access a website. It can check a registry of site (preload) or it can visit the site (over either HTTP or HTTPS) and receive a header announcing the site uses HSTS. Once the client has seen the site uses HSTS, it should remember this for a length of time (the header specifies an TTL - but the client may drop the information before this TTL expires, like any cache).

Once a HSTS-aware client knows that a site is subject to HSTS, it will automatically change any request it makes to that site from HTTP to HTTPS. Despite what it says on the OWASP site, this is not a redirect - that's something quite different in HTTP, nor is it proxying; the URL is changed in the client before being handed off to the request dispatcher. Depending on the implementation, this may appear as a redirect to the higher logic layers of the client, but no request has ever been sent at this stage in processing.

If your browser knows your favourite online store uses HSTS and a MITM is able to present a HTTP link to that site which you click on, your browser automatically upgrades the protocol, preventing most of the bad things which could happen in the absence of SSL - i.e. the MITM from reading your password, modifying the content sent back from the server, or injecting fake requests using your credentials.

Using pre-load provides the most secure implementation, but even in the header response, because your client remembers the status, HSTS is still effective.

| improve this answer | |

Without HSTS the browsers allow users to ignore certificate error and proceed further if they want to access the website.

If HSTS is set, it implies that the browsers shouldn't even give users the option ignore the error and proceed further.

| improve this answer | |

HSTS In very simple way.

Assume that you typed http://example.com in the address bar but the webserver is using TLS and configured to redirect the client to https://example.com. Now all this happens in an unsafe manner, which means that this is vulnerable to MITM (Man In The Middle) attacks.

So the HSTS comes to rescue. The client redirects itself internally to https://example.com. Now, you don't have to go to the server first and then redirect, it all happens on the client side internally. This prevents MITM attacks.

| improve this answer | |
  • MITM is only one aspect, but not the only one. And please read symcbean's answer concerning "redirects" (it's not a redirect, but a rewrite) – schroeder Jul 13 '18 at 13:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.