1

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to check whether it really works.

I understand that for HSTS to work, there shouldn't be any certificate issues & first we need to access https://somesite.com then in the next pass http request will be automatically redirected to https at client side itself.

So, I installed our self-signed certificate in the Chrome browser & restarted the browser. Now my connection to our web application was secure. But HSTS doesn't seem to work. In the successive calls to http://somesite.com, still we redirect (302) to https (automatic client-side redirection to https doesn't happen). One thing to note here is, there is no domain name associated with our web application, we access it with our server's ip within our company's internal network.

Any idea how to get HSTS working? or is it like HSTS works only if there is a domain name for the site?

  • Can you provide more info about "automatic client-side redirection to https doesn't happen" what error are you seeing? – Mike Ounsworth Aug 9 '18 at 16:16
  • I am not seeing any errors, it's just that the redirection doesn't happen. – Abhishek Sharma M Aug 9 '18 at 16:25
4

Actually, this is already answered in stackoverflow : RFC 6797 Appendix A : HSTS doesn't work for IP address.

You need to setup local DNS server to deal with it.

  • Bittersweet defeat.. I was afraid of this. This isn't ideal for a travelling dev laptop. Works fine on office WIFI with DNSMASQ but not anywheree else. Looks like local DNSMASQ. I foresee quite a few frustrations about this.. – BoeroBoy Feb 12 at 12:45
  • 2
    Correction, I found the whitelist easter egg workaround on another thread: You can type 'thisisunsafe" anywhere on the Google Chrome warning page and it will load it without warning. No joke. – BoeroBoy Feb 12 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.