Questions tagged [hsts]

HTTP Strict Transport Security is a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. It is defined by RFC 6797.

Filter by
Sorted by
Tagged with
21
votes
2answers
3k views

Is there any point in having the HSTS header enabled when using HTTP/2?

As a protection against attacks such as SSLstrip, the HSTS header prevents an attacker from downgrading a connection from HTTPS to HTTP, as long as the attributes of the header are properly configured....
2
votes
1answer
70 views

isn't it a security gap if TLD hostname doesn't send the strict-transport-security header?

If you connect to https://google.com (without www.) you get a HTTP 301 redirect to https://www.google.com/ . Then if you connect to https://www.google.com/ the response includes the strict-transport-...
1
vote
1answer
69 views

Why did browsers choose to implement HSTS with Preload over checking custom DNS information?

Browsers and standards bodies favor HSTS with Preload because it avoids ever sending an http request to a website that supports https. This is good, because cleartext http requests can be intercepted ...
-5
votes
2answers
72 views

How can HSTS preloading be avoided?

Preloading is a primitive operation. You must preload for a year or more, and "be aware that inclusion in the preload list cannot easily be undone," according to the registration tool. Therefore, if ...
1
vote
3answers
129 views

Does HSTS provide security advantages on private networks?

For systems that only connect to the internet via a single dedicated private network (no WiFi hotspots), and assuming no systems or components on that network are compromised, does HSTS (HTTP Strict ...
13
votes
1answer
726 views

Does HSTS protect against a rogue CA issuing a illegitimate valid certificate?

Does HSTS protect a domain from a publicly trusted CA that has gone rogue issuing a illegitimate valid certificate? Examples of publicly trusted CA's would be any of the members of the Mozilla CA ...
3
votes
1answer
75 views

Should the Strict-Transport-Security max-age be tied to the duration of the certificate?

I understand the principle of HSTS, and the fact that the choice of max-age limits how long a visitor could potentially be locked out if the site somehow lost its certificate and had to go back to ...
0
votes
1answer
232 views

Is it possible to browse HSTS sites over SOCKS5 proxy?

I am unable to browse HSTS websites using SOCKS5 proxy in chrome browser...getting this error... This site can’t be reached The web page at https://www.instagram.com/accounts/login/?hl=en might ...
2
votes
1answer
75 views

Does HSTS preload includes subdomains?

i know that you can preload your domain if you have everything with a valid HTTPS vertificate, but after preloading the domain if i go to subdomain.example.com is it going to me preload the same way ...
2
votes
0answers
128 views

includeSubDomains is not shown in https header after enabling hstsIncludeSubDomains in Tomcat

I enabled HSTS in the Tomcat web.xml like this: <filter> <filter-name>httpHeaderSecurity</filter-name> <filter-class>org.apache.catalina.filters....
0
votes
1answer
136 views

HSTS preload and requisites on domain - subdomains must be added too?

I found that the security header for protection against mitm attacks in first connection is to implement HSTS preload directive and add the list of google: https://hstspreload.org/ However the ...
0
votes
0answers
103 views

no HSTS but still protected to mitm attacks?

i am aware of HSTS and their directives... If you had enabled HSTS on your site however, and this user has visited your site before, the browser will remember it should go back to https. As the fake ...
2
votes
1answer
67 views

How to protect against mitm attacks in first connection? - no HSTS Preload

i have been searching around this area about mitm attacks and realize that every single page that doesn't have HSTS preload is vunerable to mitm attacks in first connection to the site. the solution ...
6
votes
1answer
949 views

How to force a browser when connecting to a specific domain to be https only using only the client machine?

Is it possible to force a client (browser or host machine or etc) to only make https connections to a specific URL/domain? (preferably non-admin/root fixes if possible) Here is a fabricated ...
2
votes
1answer
214 views

HSTS and TLS redirection: What is the correct order?

Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=63072000; ...
0
votes
0answers
538 views

SSLStrip demonstration with bettercap 2.x

I'm trying to get bettercap 2.x working for an sslstrip proof of concept demonstration. I'm running it against a site that I know doesn't properly implement HSTS, found from several blogs. The site ...
3
votes
0answers
44 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
0
votes
1answer
57 views

HSTS mixed with HTTP resources

We have a container site which implements HSTS and a video sharing site which is using HTTP only and doesn't have TLS implemented, nor will it. How does one avoid mixed content in container site and ...
1
vote
1answer
66 views

Is there *ANY* conceptual downside to enabling preloaded HSTS on greenfield

Referencing this: https://hstspreload.org/ There's a bunch of stuff about making really sure that it all works before you get them to pre-load it: when testing first test with a max-age of 5 minutes,...
1
vote
0answers
24 views

Is HSTS necessary or can I just write .htaccess code to always redirect http to https? [duplicate]

Is HTTP Strict Transport Security (HSTS) necessary or can I just write regular .htaccess code to always redirect http to https?
1
vote
0answers
39 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
3
votes
0answers
167 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
1
vote
1answer
109 views

HSTS vs RewriteRule

I've recently read that HSTS is designed to avoid some of the vulnerabilities associated with htaccess redirects to force HTTPS, because the browser can be made to ignore them. That said, many of our ...
2
votes
2answers
835 views

HSTS for android apps?

Websites such as Facebook visited on browsers have the HSTS capability which is one more layer of security for TLS from some attacks. What about, in particular, the Facebook android app? Does it ...
1
vote
2answers
3k views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
3
votes
0answers
346 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
2
votes
4answers
1k views

How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?

I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful. However, I noticed ...
1
vote
1answer
2k views

HSTS doesn't work on browser when dealing with a self-signed certificate

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
1
vote
1answer
717 views

Why does bettercap and sslstrip work sometimes on Google and Facebook?

sslstrip and bettercap work “sometimes” on Chrome browsers on sites such as Facebook, Google, AOL, and other sites that use preload HSTS. Why does it work sometimes when it shouldn’t work at all?
1
vote
1answer
375 views

Bypassing HSTS and Public-key pinning with lookalike characters

Using lookalike character symbols to circumvent HSTS and public-key pinning with DNS spoofing via MITM Attack. Redirect: facebook.com --> faceḃook.com -- I have seen SSLStrip+ using the technique ...
6
votes
1answer
1k views

Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)

I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
-1
votes
3answers
95 views

What is the use of HSTS on a website? [duplicate]

I know HSTS redirects HTTP requests to HTTPS for the target domain, or it helps in restricting downgrading HTTPS to HTTP. But I don't get the basic idea behind HSTS. I have gone through various ...
0
votes
1answer
222 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
2
votes
2answers
605 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
1
vote
1answer
261 views

How does faked DNS manage to downgrade preloaded HSTS?

Yesterday, in a bid to entertain myself for a while, I was playing around with DNS servers. I set up a DNS server locally, which I then set as my primary DNS server. Within it, I added some records ...
1
vote
0answers
93 views

HSTS over HTTP-CDN-HTTPs chain [closed]

I'm using CloudFlare's flexible SSL: Flexible SSL: You cannot configure HTTPS support on your origin, even with a certificate that is not valid for your site. Visitors will be able to access ...
3
votes
1answer
796 views

Google's Certificate Fingerprint doesn't match with the Fingerprints in the Chrome's “net-internals” configurations

As you may know, you can query chrome's HSTS/PKP sets for a domain in the page chrome://net-internals as below: As you see above, there are four SHA256 hash values (in the middle of page and in ...
3
votes
2answers
2k views

List of sites that still dont support HSTS?

I'm working on an article for work and seeking a list of the top ~500 websites (ranked by Alexa) that still don't have support for HSTS. Does such a list exist? I'm not getting any interesting hits ...
5
votes
2answers
466 views

Do you need DNSSEC if you use HSTS? [duplicate]

I'm trying to understand the benefits of DNSSEC. If a user goes to my site example.com and the DNS cache was poisoned redirecting the user to the bad guy's IP, what would happen? I've enabled HSTS. ...
16
votes
2answers
2k views

Security benefit of browsers automatically rewriting HTTP to HTTPS? [duplicate]

I often use a guest WiFi which does the usual intercept; attempt to navigate to any HTTP website and it redirects you to the "Agree to our ToS" page, after which it will permit any traffic from your ...
7
votes
1answer
2k views

HSTS: Clicking through certificate errors

We have a website www.example.com with a certificate for domain www.example.com, we also have HSTS enabled. The Qualys SSL Labs (https://www.ssllabs.com/index.html) confirmed that HSTS has been ...
1
vote
1answer
738 views

Is HSTS header any useful without a recognized certificate?

The application I'm working on is accessible only via IP address, so HTTPS connection is provided via a custom-signed certificate. I explained to my client that (from MDN docs) [...] when your ...
2
votes
1answer
144 views

What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django?

At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work. I do have the ...
12
votes
5answers
5k views

How do you prevent sending cookie data over HTTP the first time? [duplicate]

You could use HSTS to tell browser to always use HTTPS in future requests. You could use Cookie Secure flag that from now on only send cookies over HTTPS. You could use DNS based redirect but only ...
2
votes
1answer
112 views

HSTS Cache Policy for Root Domain

Let's imagine my main website is https://www.example.com, but a user types in http://www.example.com. Should this redirect straight to https://www.example.com, or should it first redirect to https://...
5
votes
3answers
1k views

Upgrade-Insecure-Requests as an alternative for HSTS

I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header. So does the following line in the request fully alleviate the ...
2
votes
1answer
173 views

Why wouldn't you institute Strict-Transport-Security headers?

I read recently that HSTS can cause problems with site access. Under what circumstances might that happen and what are safe HSTS settings to implement on my web server?
-1
votes
1answer
947 views

How does browsers detects HSTS sites?

I have come across scenarios where we introduce a proxy which does SSL decryption and it fails on HSTS sites, e.g. Facebook, Gmail, etc. In a MITM proxy setup the Facebook page will be signed by the ...
5
votes
2answers
3k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
5
votes
1answer
658 views

What is the implication of HSTS on unsupported browsers?

HSTS is currently available only on Edge and IE11. What will be its implication on lower browser versions (IE9 & IE10)? How will HSTS behave? Will there be any impact on the site?