Websites such as Facebook visited on browsers have the HSTS capability which is one more layer of security for TLS from some attacks.

What about, in particular, the Facebook android app? Does it have HSTS? We already discussed that this app and many more have at least TLS.

In another thread I read that for apps HSTS is not important.

  • 5
    HSTS is the server telling the browser to only use HTTPS, for an app you can just code it so that it doesn't use HTTP in the first place. – AndrolGenhald Oct 17 '18 at 14:20
  • Thanks. But for an app (facebook) that we already know uses https, we don't have to code anything right? – Mark88 Oct 17 '18 at 14:27
  • @Mark88 "we don't have to code anything" - what would you be coding? – schroeder Oct 17 '18 at 15:54
  • Currently facebook.com domain is doing HSTS preloading. And since HSTS is mean to prevent domain hijacking, if the facebook apps doesn't honor HSTS, then it is susceptible to hijack. HOWEVER, facebook can make use of other proprietary way to make sure the it is indeed connecting to facebook server. – mootmoot Oct 17 '18 at 16:29

Does the Facebook app use HSTS for Android/iOS? No. It doesn’t need to. HSTS is specific for telling web browsers like Chrome, Firefox, etc. to interact with their web service via HTTPS only.

A mobile app will have HTTPS hard coded in the app itself making it the only option. I believe Apple requires this for any apps and for Android it looks like they are moving towards HTTPS for apps as well. Android HTTPS.

If you are developing an application yourself and want users to only use HTTPS then you would simply call your backend services using only HTTPS and have that coded right into your application whether android or iOS. Example: https://api.example.com/data

The reason why HSTS isn’t needed in the mobile app environment is because in the web browser a user can go to a base url like example.com over HTTP. The user has more control in a web browser environment on how they want to navigate to your website. Also indexing and back linking to your website, people can specify which protocol HTTP or HTTPS when linking to your website. So that’s why you need HSTS in a web browser environment to tell the browser, “only talk to me in HTTPS even if someone says they want HTTP” but in a mobile environment, as a developer you are the one that gets to specify HTTPS in the code in your app for interacting with the backend service. Users don’t need to manually navigate to a url because that is all coded in the app Facebook or you built. The users just have to open the app. So as a developer you get more say on how the app should interact with your web service. It’s your app, your client, you tell it what to do but you didn’t build Chrome or Firefox, it’s someone else’s client so you need to tell them via HSTS how it should interact with your web service.

  • Thanks nd510. No need for HSTS for apps. With regards to android apps we already discussed in another thread that FB apps for android are https – Mark88 Oct 17 '18 at 16:44

HSTS can prevent protocol downgrade attacks during MITM. Most of the mobile applications use certificate pinning.

  • 2
    So, do apps use HSTS? Does Facebook's app? You don't address that question. – schroeder Oct 17 '18 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.