How can I force certain the webclient to honor or remember certain parameters from the webserver?

Question

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted sites.

Based on my (average) knowledge of MITM vectors, it would be beneficial to secure specific domains with client/browser behavior that forced any of the following settings :

• Only use HTTPS when connecting domain X

• Require an If-Modified-Since header. Ideally, I want cached content to never expire, regardless of what the "server" says.

• Require SSL Only Cookies. I am looking for a way for the browser to require SSL Only cookies by DNS domain name, and possibly by cookie name.

• Ignore 30x redirects.

Ultimately, I would like to take the recommendations and format them into a security guide for the end user, or actually deploy them internally to all internal clients, when connecting to a secured list of websites.

Answer 1

HTTP Strict Transport Security (HSTS), a feature introduced by Chrome (http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is a nice move towards security against MITM.

Other options you mention would be sure to break many sites. Requiring secure-flag cookies for instance (and thus ignoring those without?) would break a lot of sites, as would ignoring 302's.

Answer 2

If you use Firefox: install HTTPS Everywhere. It has a list of sites that support SSL, and will make sure the browser always connects to them over SSL-encrypted https (never over unencrypted http).

(If you are really concerned about security, you could also add NoScript. However, this is likely to be difficult for the average end user to use, so I don't recommend it, if this is for general-purpose use..)

I am not so sure about the other behaviors you want to be enforced. I am concerned that they may "break the web": they may cause many web sites not to work. That might be problematic. If people find that their browser does not work for many sites they care about, there is a significant likelihood they will change to a different browser if they can (or curse the IT department, if they can't). In any case, regardless of desirability, I do not have pre-packaged software that does what you want; you will probably need to build your own extension.