Is a forced rewrite from http to https secure? What does SSLRequireSSL add?

Question

I've read contradicting advice about forcing https connections in the following way:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

To me it seems this wouldn't allow anyone to pass a http request. Is there any disadvantage to this approach?

What security does adding

SSLRequireSSL

to the <directory /> part add? I know it will force Apache to bounce non-https requests but will they ever get through anyways?

Or in other words: What is the best way of implementing a https-only site, if not this?

We do not have an EV certificate, neither do we have a large user base. What we have is a series of survey sites where we want to make http impossible.

Answer 1

What is the best way of implementing a https-only site, if not this?

Use a separate virtual server for the HTTP, not linked to any of the resources of the 'real' HTTPS site.

To ensure that modern browsers will refuse to use plain HTTP for your site in the future, use the Strict Transport Security header.

eg.

<VirtualHost *:80>
    ServerName www.example.com
    Redirect permanent / https://www.example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    Header set Strict-Transport-Security "max-age=8640000;includeSubdomains"
    ...site settings...
</VirtualHost>

What does SSLRequireSSL add?

It can be useful to protect particular resources if you're in a virtualhost with SSLEngine optional, or in a piece of included config shared by both an HTTP and HTTPS virtualhost.

Answer 2

As I was saying in this answer on Webmasters.SE, the only general solution to this problem is to give your users the https:// address only and make sure that they expect to use that only. It is ultimately the responsibility of the user to check that they are using SSL/TLS, as they expect.

One way to try to enforce this automatically is to encourage the users to use a browser that supports HTTP Strict Transport Security (again, until all browsers support it, this requires user awareness).

Other forms of server-forced upgrades (including shutting down the plain HTTP port) will be vulnerable to MITM attacks. This being said:

• Forced redirections from http:// to https:// will protect the user against eavesdropping passive attacks. It may also help raise awareness of the issue to the user (i.e. if they connect from a network they can trust, they'll get used to it, and may find it odd not to see https:// on other networks). For those reasons, it's worth doing anyway; you're at least mitigating the risk.
• It would be ideal to get more sites into the pre-loaded HSTS list, so as not to be vulnerable, even on the first connection. However, when using HSTS, a connection on a trusted network once with that browser configuration should be sufficient to tell the browsers to keep using HTTPS for that site.

Once this is done, you still need to tell users not to ignore certificate warnings.

(It's always better to combine all this with secure cookies, if cookies are used.)

Answer 3

The http redirect is not as secure as simply denying access through http.

People who use the HTTP address will still be vulnerable to an active MITM. I can intercept the redirect to HTTPS, and modify it. I could keep them on HTTP, or I could redirect to my own HTTPS site (to match the "padlock" you show when I'm not intercepting). I can use a domain name that looks very much like your own, or some plausible alternative.

Admittedly, my attack would be easier for users to spot if you use an EV certificate. But if it was worth paying for an EV certificate, you probably have high security requirements and a large user base, so you should still be disabling the HTTP access in order to provide some defence in depth.