21

The Google Chrome browser offers a quick way to check a domain's HSTS (HTTP Strict Transport Security) status via the page chrome://net-internals/#hsts (section Query domain).

The query result looks e.g. like this:

Found:
domain: owasp.org
static_upgrade_mode: UNKNOWN
static_sts_include_subdomains: 
static_pkp_include_subdomains: 
static_sts_observed: 
static_pkp_observed: 
static_spki_hashes: 
dynamic_upgrade_mode: STRICT
dynamic_sts_include_subdomains: false
dynamic_pkp_include_subdomains: false
dynamic_sts_observed: 1409173001.03746
dynamic_pkp_observed: 1409173001.03746
dynamic_spki_hashes:

What do these lines mean? Is the HSTS mode enabled or not? What is the difference between the dynamic_ and static_ entries of the result?

Improve this question

3 Answers 3

Reset to default
15

If either of the static_upgrade_mode: or the dynamic_upgrade_mode: lines are set to STRICT then HSTS is enabled.

Dynamic

Dynamic means that the browser has been instructed to enable HSTS by an HTTP response header (served over TLS) similar to the following:

Strict-Transport-Security: max-age=157680000; includeSubDomains;

This is vulnerable to an attack whereby the very first time the browser requests the domain with http:// (not https://) an adversary intercepts the communication.

Static

In order to overcome this weakness we have the static mode which allows for hard-coding HSTS records directly into the browser's source. The header is changed to indicate the administrator's intention:

Strict-Transport-Security: max-age=157680000; includeSubDomains; preload

Note the inclusion of preload at the end. The domain is then submitted for review. If approved then it is added to the Chromium list which is also included in the Firefox, Safari, and IE 11+Edge lists.

Improve this answer
4

When you are querying to chrome://net-internals/#hsts then it queries only the stored HSTS sites that you have visited using chrome. The part static_ and dynamic_ shows the methods to enable STS for the communication.

The result shows there is no static methods defined only dynamic methods are there. pop and sts in the result stand for public-key-pinning and strict transport security repectively. So dynamic_pkp_observed and dynamic_sts_obeserved is the time for STS which is enabled for the doamin. The STS is allowed on that domain but not for subdomains.

It would be better to use "curl" for checking the sts.
For example:
curl -siL "owasp.org" | grep "Strict" (-L to redirect to https)

If the domain is configured to use STS then in the server response you will see the header Strict-Transport-Security: max-age =value
That is why I'm gripping for Strict.

Improve this answer
4
  • Thanks for the answer so far. I feel still somehow dumb (as if everybody would understand the topic but me), but I'll ask the questions anyway: What is the difference between dynamic and static? What does the upgrade modes (UNKNOWN, STRICT, OPPORTUNISTIC) again mean? I have tried playing with curl in my cygwin. I could never see the HSTS header attribute in any domain I have tried (google, gmail, owasp, ...). What am I doing wrong? BTW. Any good books on this topic?
    – Marek Puchalski
    Commented Oct 3, 2014 at 19:48
  • 1
    Static means the server will always communicate over hsts it doesn't require client to configure your browser to use hsts for that page. In the other hand dynamic means if the user is requesting that page over hsts. Static unknown means the server doesn't support hsts by itself. Strict means the server will use hsts for all the communications.
    – ifexploit
    Commented Oct 4, 2014 at 6:51
  • So why do I not see the Strict-Transport-Security: max-age =value when I run that curl above? If HSTS is critical, then I'd expect OWASP to implement it, right? Instead I seem to be looking at an Apache/Nginx 301 Redirect to the HTTPS domain. Is the Strict-Transport-Security header no longer how it works 2 years after this answer?
    – Randy L
    Commented Nov 29, 2016 at 21:11
  • Should be curl -si "h t t p s://owasp.org" | grep "Strict", because the header is only sent on https. The request to http should include a redirect to https. curl -siL owasp.org|grep "Strict" will work, because L makes curl follow this redirect.
    – Lenne
    Commented Feb 2, 2017 at 11:15
1

static means browser (in this case Chrome) Preloaded HSTS sites
dynamic means sites that got picked up "on the go" or added manually

pkp stands for Public Key Pinning, which is since Chrome 69 deprecated
spki_hashes stands for SubjectPublicKeyInfo hashes

_include_subdomains mean whether to include subdomains in the request
_observed is the UNIX time on which the browser first observed the request
_expiry is the UNIX time on which the browser will forget the request

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .