6

Is it possible to force a client (browser or host machine or etc) to only make https connections to a specific URL/domain?

(preferably non-admin/root fixes if possible)

Here is a fabricated scenario:

Lets say someone hosted a website, and they didn't put in an http -> https redirect and the web-server is serving requests on both 80/443 http/https respectively.

We are the client machine we work at a company and they wont fix the web-server for one reason or another. We do not have other machines to use as a proxy and have no control over the network. Now we could just make a bookmark (or other form of workflow that forces our actions to always reach https) but there has to be a way built in to browsers that can, say, "Do not connect to this domain/url unless using this protocol".

This would be my preferred approach if possible.

This is very frustrating for people who are security focused as accidentally hitting the http version will leak your session ID and if you login there RIP password.

I searched online but surprisingly found nothing.

Improve this question
4
  • 1
    Turns out "security.stackexchange.com/questions/143703/…" showed up as a related question. And this can work. However, is there really not a built in feature to force protocols for domains within browsers(meaning without 3rd party addon/software)?
    – 0xKate
    Apr 20, 2019 at 15:42
  • 1
    - The primary reason for this, a very common thing that is overlooked, using a website to redirect http->https is technically not stopping the initial packets sent to the website over the internet. Technically downgrading your URL on any https site to http and hitting enter (even if port 80 is closed on the destination ip) will send unencrypted data onto the internet. Thus doing this on the web-server, is actually very insecure and is not really protecting the clients initial communication, but only subsequent communication.
    – 0xKate
    Apr 20, 2019 at 15:49
  • You want the site to use HSTS and you might want to do HSTS Preload (hstspreload.org). You can't do it from the client.
    – Z.T.
    Apr 20, 2019 at 15:57
  • Turns out HSTS is the certified approach to fixing this common problem I mentioned. Thanks everyone.
    – 0xKate
    Apr 20, 2019 at 16:23

1 Answer 1

Reset to default
5

You've found already that this can be done with an extension like HTTPS Everywhere. And you've found out that the browser will not do this by default. Thus there is the option of "doing nothing with the browser", which doesn't provide the protection or the option of "doing something in the client" which is already a solved problem by installing a plugin. Apart from that there is HSTS preloading where the browser knows that some specific sites will always use HTTPS even if the browser has never connected to these sites before.

If you want something like HSTS preloading but for domains which are not in the HSTS public preload list it is possible in Chrome to add additional domains to the local HSTS list by accessing chrome://net-internals/#hsts. See also Manually enforcing HSTS in Google Chrome.

Improve this answer
2
  • I knew about HSTS a little but never heard of HSTS preloading that sounds about what im looking for. This is perfect thank for for pointing out the chrome internals. Thank you for your answer.
    – 0xKate
    Apr 20, 2019 at 16:04
  • @Kirin You could enforce the installation of the HTTPS everywhere extension via global configuration / group policy as well.
    – Nonny Moose
    Apr 22, 2019 at 16:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .