15

By definition, incognito mode shouldn't leave a trail of visited websites.

However, HSTS (HTTP Strict Transport Security) requires the browser to keep a database of hosts that have requested HSTS, and honor HSTS for subsequent requests.

This introduces a conflict and there are two possible ways of resolving it:

  1. Browsers always honor HSTS requests made inside an incognito session, even when browsing outside of the incognito session.

  2. Browsers honor HSTS requests made inside an incognito session for that session only.

Which of them is implemented in popular browsers?

Additionally, as discussed in the comments, do HSTS requests outside incognito session affect requests inside incognito session?

Improve this question
4
  • You could add to your question whether an incognito session will follow a HSTS header set outside of incognito mode.
    – SilverlightFox
    Commented Aug 7, 2014 at 6:07
  • @SilverlightFox I don't see a conflict or ambiguity in that case. Outside the incognito mode, it is usual to keep a history of visits.
    – HRJ
    Commented Aug 7, 2014 at 6:11
  • 2
    Yes but state does not usually follow through to incognito mode. For example, cookies set outside of incognito mode cannot be read inside incognito mode. I wondered if the same applied to HSTS. If not, a site could determine whether it had been previously visited by creating a plain HTTP request to find out whether it is converted to HTTPS or not.
    – SilverlightFox
    Commented Aug 7, 2014 at 7:07
  • @SilverlightFox Good point. I was only thinking of requests originating from location bar. I will add the question in.
    – HRJ
    Commented Aug 7, 2014 at 10:31

2 Answers 2

Reset to default
3

In Firefox, the HSTS set is not shared between normal and private browsing mode, as of Firefox 34.

Internet Explorer (11) does not support HSTS.

In Chromium and Opera, the HSTS set is unique for each browsing profile (normal and incognito). This can easily be verified by visiting chrome://net-internals/#hsts:

  1. Start a new Chrome session to get a clean state, e.g. chrome.exe --user-data-dir=%TMP%\whatever on Windows.
  2. Visit chrome://net-internals/#hsts and input a domain that uses HSTS, such as "addons.mozilla.org" in the search box, and press "Query". It should not report any domains.
  3. Open an incognito window and visit addons.mozilla.org. Retry step 2 and observe that the result is still empty.
  4. Repeat step 2 in the incognito window, and observe that the query yields a result.
  5. The previous steps show that HSTS does not leak through from normal to incognito. Start all over again, but exchange the last steps and observe that the reverse is also true: HSTS does not leak from normal browsing mode to incognito mode.
Improve this answer
5
  • 1
    In my testing I found HSTS does leak from normal browsing mode to incognito mode. Specifically, under normal mode: visit a site with HSTS over http. server 301s to https, https returns HSTS response. new incognito mode connection. attempt to visit URL - immediate tunnel to https, no request over http. with clean normal profile multiple incognito visits can be made to http URL.
    – bkr
    Commented Aug 7, 2014 at 23:34
  • Have you used a clean browsing profile? Which steps did you follow to establish that HSTS leaks?
    – Rob W
    Commented Aug 7, 2014 at 23:37
  • Quote from radicalresearch.co.uk/lab/hstssupercookies: The release of version 34.0 of Firefox seems to have changed. Unlike Google Chrome, Firefox has chosen to prefer privacy over security and no longer carries HSTS over to private windows.
    – SleepProgger
    Commented Oct 21, 2015 at 23:33
  • @SleepProggger Thanks for the info. I've confirmed that the HSTS state sharing logic changed in Firefox 34.
    – Rob W
    Commented Oct 22, 2015 at 10:30
  • Until Chrome 64, Incognito mode inherited HSTS rules from non-Incognito mode. sites.google.com/a/chromium.org/dev/Home/chromium-security/…
    – EricLaw
    Commented Nov 8, 2017 at 17:59
3

using Fiddler and visiting a site with HSTS enabled

honor HSTS in incognito if set previously in non-incognito (ie, immediately tunnel to HTTPS, do not request HTTP url)

  • Chrome : YES
  • Firefox : YES
  • IE 11 : doesn't seem to honor HSTS

honor HSTS in incognito if previously visited site in incognito only (ie, immediately tunnel to HTTPS, do not request HTTP url)

  • Chrome : NO
  • Firefox : NO
  • IE 11 : doesn't seem to honor HSTS

looks like IE is meant to support it in IE 12 - http://www.cso.com.au/article/542244/microsoft_confirms_http_strict_transport_security_ie_12/

Improve this answer
1
  • Update: Chrome now does not carry hsts over from normal to private, nor does it from private to private session. Hsts will be reset every new private session.
    – Nicholas Porter
    Commented Jul 8, 2021 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .