12

By definition, incognito mode shouldn't leave a trail of visited websites.

However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, and honor HSTS for subsequent requests.

This introduces a conflict and there are two possible ways of resolving it:

  1. Browsers always honor HSTS requests made inside an incognito session, even when browsing outside of the incognito session.

  2. Browsers honor HSTS requests made inside an incognito session for that session only.

Which of them is implemented in popular browsers?

Additionally, as discussed in the comments, do HSTS requests outside incognito session affect requests inside incognito session?

  • You could add to your question whether an incognito session will follow a HSTS header set outside of incognito mode. – SilverlightFox Aug 7 '14 at 6:07
  • @SilverlightFox I don't see a conflict or ambiguity in that case. Outside the incognito mode, it is usual to keep a history of visits. – HRJ Aug 7 '14 at 6:11
  • 2
    Yes but state does not usually follow through to incognito mode. For example, cookies set outside of incognito mode cannot be read inside incognito mode. I wondered if the same applied to HSTS. If not, a site could determine whether it had been previously visited by creating a plain HTTP request to find out whether it is converted to HTTPS or not. – SilverlightFox Aug 7 '14 at 7:07
  • @SilverlightFox Good point. I was only thinking of requests originating from location bar. I will add the question in. – HRJ Aug 7 '14 at 10:31
3

In Firefox, the HSTS set is not shared between normal and private browsing mode, as of Firefox 34.

Internet Explorer (11) does not support HSTS.

In Chromium and Opera, the HSTS set is unique for each browsing profile (normal and incognito). This can easily be verified by visiting chrome://net-internals/#hsts:

  1. Start a new Chrome session to get a clean state, e.g. chrome.exe --user-data-dir=%TMP%\whatever on Windows.
  2. Visit chrome://net-internals/#hsts and input a domain that uses HSTS, such as "addons.mozilla.org" in the search box, and press "Query". It should not report any domains.
  3. Open an incognito window and visit addons.mozilla.org. Retry step 2 and observe that the result is still empty.
  4. Repeat step 2 in the incognito window, and observe that the query yields a result.
  5. The previous steps show that HSTS does not leak through from normal to incognito. Start all over again, but exchange the last steps and observe that the reverse is also true: HSTS does not leak from normal browsing mode to incognito mode.
  • 1
    In my testing I found HSTS does leak from normal browsing mode to incognito mode. Specifically, under normal mode: visit a site with HSTS over http. server 301s to https, https returns HSTS response. new incognito mode connection. attempt to visit URL - immediate tunnel to https, no request over http. with clean normal profile multiple incognito visits can be made to http URL. – bkr Aug 7 '14 at 23:34
  • Have you used a clean browsing profile? Which steps did you follow to establish that HSTS leaks? – Rob W Aug 7 '14 at 23:37
  • Quote from radicalresearch.co.uk/lab/hstssupercookies: The release of version 34.0 of Firefox seems to have changed. Unlike Google Chrome, Firefox has chosen to prefer privacy over security and no longer carries HSTS over to private windows. – SleepProgger Oct 21 '15 at 23:33
  • @SleepProggger Thanks for the info. I've confirmed that the HSTS state sharing logic changed in Firefox 34. – Rob W Oct 22 '15 at 10:30
  • Until Chrome 64, Incognito mode inherited HSTS rules from non-Incognito mode. sites.google.com/a/chromium.org/dev/Home/chromium-security/… – EricLaw Nov 8 '17 at 17:59
3

using Fiddler and visiting a site with HSTS enabled

honor HSTS in incognito if set previously in non-incognito (ie, immediately tunnel to HTTPS, do not request HTTP url)

  • Chrome : YES
  • Firefox : YES
  • IE 11 : doesn't seem to honor HSTS

honor HSTS in incognito if previously visited site in incognito only (ie, immediately tunnel to HTTPS, do not request HTTP url)

  • Chrome : NO
  • Firefox : NO
  • IE 11 : doesn't seem to honor HSTS

looks like IE is meant to support it in IE 12 - http://www.cso.com.au/article/542244/microsoft_confirms_http_strict_transport_security_ie_12/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.