How can a site preemptively notify browsers to enforce an SSL on their domain?

Question

I learned about this years ago and don't remember enough of the keywords to search for it appropriately.

Its where sites can tell the browser that the site must not allow the site to be downgraded to HTTP.

Answer 1

HTTP Strict Transport Security Preloading

This is the keyword you are looking for. If that's all you care about, then I'm happy I could help. However, if you would like to know why this is done, please keep reading.

HTTP to HTTPS redirects

This is the simplest form of ensuring your users only use HTTPs. Once a HTTP URL is requested, the server replies with a 301 response, redirecting the browser to the HTTPS location instead. http://example.com/foo/bar becomes https://example.com/foo/bar.

However, this means that whenever a client requests the HTTP site (potentially, whenever they want to go to your site via e.g. a bookmark), they can be intercepted by an attacker and potentially never redirected.

Attack Surface: Whenever they connect via HTTP.

HTTP Strict Transport Security (without Preloading)

In order to alleviate this, the HSTS system was developed. It works as follows: Every browser that supports HSTS has a HSTS cache. When a user tries to navigate to a domain via HTTP for which a HSTS entry is present, the request is automatically changed to HTTPS. So even if I explicitly typed http://example.com, my browser would request https://example.com (as long as example.com was in my HSTS cache).

How do sites signify that they support HSTS? By placing a HTTP response header into every request. While technically it's not necessary to do so for every request, the downsides are minimal. The header looks like this:

Strict-Transport-Security: max-age=31536000

The "max-age" parameter defines how long this request should be honored (in seconds). Typically a time of one year is chosen - although why this was done is anyone's guess. And while this is really nice and will protect your users on every subsequent visit, there is still the problem of when they first visit your site. After all, if they never visited your site, there is no way for them to know that you support HSTS. It's a chicken and egg problem. So the first time, there will still be a plaintext communication that can be intercepted.

Attack Surface: The first time they connect via HTTP.

HTTP Strict Transport Security with Preloading

So our goal now is to tell the user that we support HSTS without prior communication to the user. The solution is to use a so-called "preload list". The idea is simple: The website operator tells a list that they support HSTS and will continue to do so in the future.

The browser then gets this information¹ through an already secure connection. As such, browsers will be able to know whether or not they should use HTTPS exclusively without ever having to communicate in plaintext.

Attack Surface: None.

---

¹ I actually don't know if browsers regularly download the whole preload list or if they query individual domains. Turns out browsers get a new copy of the HSTS preload list whenever the browser is updated.