5

Is it possible to force a client (browser or host machine or etc) to only make https connections to a specific URL/domain?

(preferably non-admin/root fixes if possible)

Here is a fabricated scenario:

Lets say someone hosted a website, and they didn't put in an http -> https redirect and the web-server is serving requests on both 80/443 http/https respectively.

We are the client machine we work at a company and they wont fix the web-server for one reason or another. We do not have other machines to use as a proxy and have no control over the network. Now we could just make a bookmark (or other form of workflow that forces our actions to always reach https) but there has to be a way built in to browsers that can, say, "Do not connect to this domain/url unless using this protocol".

This would be my preferred approach if possible.

This is very frustrating for people who are security focused as accidentally hitting the http version will leak your session ID and if you login there RIP password.

I searched online but surprisingly found nothing.

  • 1
    Turns out "security.stackexchange.com/questions/143703/…" showed up as a related question. And this can work. However, is there really not a built in feature to force protocols for domains within browsers(meaning without 3rd party addon/software)? – Kirin Apr 20 at 15:42
  • - The primary reason for this, a very common thing that is overlooked, using a website to redirect http->https is technically not stopping the initial packets sent to the website over the internet. Technically downgrading your URL on any https site to http and hitting enter (even if port 80 is closed on the destination ip) will send unencrypted data onto the internet. Thus doing this on the web-server, is actually very insecure and is not really protecting the clients initial communication, but only subsequent communication. – Kirin Apr 20 at 15:49
  • You want the site to use HSTS and you might want to do HSTS Preload (hstspreload.org). You can't do it from the client. – Z.T. Apr 20 at 15:57
  • Turns out HSTS is the certified approach to fixing this common problem I mentioned. Thanks everyone. – Kirin Apr 20 at 16:23
5

You've found already that this can be done with an extension like HTTPS Everywhere. And you've found out that the browser will not do this by default. Thus there is the option of "doing nothing with the browser", which doesn't provide the protection or the option of "doing something in the client" which is already a solved problem by installing a plugin. Apart from that there is HSTS preloading where the browser knows that some specific sites will always use HTTPS even if the browser has never connected to these sites before.

If you want something like HSTS preloading but for domains which are not in the HSTS public preload list it is possible in Chrome to add additional domains to the local HSTS list by accessing chrome://net-internals/#hsts. See also Manually enforcing HSTS in Google Chrome.

  • I knew about HSTS a little but never heard of HSTS preloading that sounds about what im looking for. This is perfect thank for for pointing out the chrome internals. Thank you for your answer. – Kirin Apr 20 at 16:04
  • @Kirin You could enforce the installation of the HTTPS everywhere extension via global configuration / group policy as well. – Nonny Moose Apr 22 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.