Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hsts]

HTTP Strict Transport Security is a mechanism enabling web sites to declare themselves accessible only via secure connections and/or for users to be able to direct their user agent(s) to interact with given sites only over secure connections. It is defined by RFC 6797.

1
vote
0answers
20 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
2
votes
0answers
80 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
1
vote
1answer
84 views

HSTS vs RewriteRule

I've recently read that HSTS is designed to avoid some of the vulnerabilities associated with htaccess redirects to force HTTPS, because the browser can be made to ignore them. That said, many of our ...
2
votes
2answers
79 views

HSTS for android apps?

Websites such as Facebook visited on browsers have the HSTS capability which is one more layer of security for TLS from some attacks. What about, in particular, the Facebook android app? Does it ...
1
vote
2answers
198 views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
1
vote
0answers
115 views

Why are banks largely absent from the HSTS preload list?

There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from ...
2
votes
4answers
276 views

How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?

I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful. However, I noticed ...
1
vote
1answer
262 views

HSTS doesn't work on browser when dealing with a self-signed certificate

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
1
vote
1answer
383 views

Why does bettercap and sslstrip work sometimes on Google and Facebook?

sslstrip and bettercap work “sometimes” on Chrome browsers on sites such as Facebook, Google, AOL, and other sites that use preload HSTS. Why does it work sometimes when it shouldn’t work at all?
1
vote
1answer
97 views

Bypassing HSTS and Public-key pinning with lookalike characters

Using lookalike character symbols to circumvent HSTS and public-key pinning with DNS spoofing via MITM Attack. Redirect: facebook.com --> faceḃook.com -- I have seen SSLStrip+ using the technique ...
6
votes
1answer
610 views

Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)

I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
-1
votes
3answers
87 views

What is the use of HSTS on a website? [duplicate]

I know HSTS redirects HTTP requests to HTTPS for the target domain, or it helps in restricting downgrading HTTPS to HTTP. But I don't get the basic idea behind HSTS. I have gone through various ...
0
votes
1answer
130 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
1
vote
2answers
292 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
1
vote
1answer
80 views

How does faked DNS manage to downgrade preloaded HSTS?

Yesterday, in a bid to entertain myself for a while, I was playing around with DNS servers. I set up a DNS server locally, which I then set as my primary DNS server. Within it, I added some records ...
1
vote
0answers
61 views

HSTS over HTTP-CDN-HTTPs chain [closed]

I'm using CloudFlare's flexible SSL: Flexible SSL: You cannot configure HTTPS support on your origin, even with a certificate that is not valid for your site. Visitors will be able to access ...
3
votes
1answer
273 views

Google's Certificate Fingerprint doesn't match with the Fingerprints in the Chrome's “net-internals” configurations

As you may know, you can query chrome's HSTS/PKP sets for a domain in the page chrome://net-internals as below: As you see above, there are four SHA256 hash values (in the middle of page and in ...
1
vote
2answers
485 views

List of sites that still dont support HSTS?

I'm working on an article for work and seeking a list of the top ~500 websites (ranked by Alexa) that still don't have support for HSTS. Does such a list exist? I'm not getting any interesting hits ...
3
votes
2answers
183 views

Do you need DNSSEC if you use HSTS? [duplicate]

I'm trying to understand the benefits of DNSSEC. If a user goes to my site example.com and the DNS cache was poisoned redirecting the user to the bad guy's IP, what would happen? I've enabled HSTS. ...
16
votes
2answers
2k views

Security benefit of browsers automatically rewriting HTTP to HTTPS? [duplicate]

I often use a guest WiFi which does the usual intercept; attempt to navigate to any HTTP website and it redirects you to the "Agree to our ToS" page, after which it will permit any traffic from your ...
7
votes
1answer
1k views

HSTS: Clicking through certificate errors

We have a website www.example.com with a certificate for domain www.example.com, we also have HSTS enabled. The Qualys SSL Labs (https://www.ssllabs.com/index.html) confirmed that HSTS has been ...
1
vote
1answer
284 views

Is HSTS header any useful without a recognized certificate?

The application I'm working on is accessible only via IP address, so HTTPS connection is provided via a custom-signed certificate. I explained to my client that (from MDN docs) [...] when your ...
2
votes
1answer
70 views

What are the implications of removing SECURE_HSTS_INCLUDE_SUBDOMAINS = True with Django?

At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work. I do have the ...
12
votes
5answers
4k views

How do you prevent sending cookie data over HTTP the first time? [duplicate]

You could use HSTS to tell browser to always use HTTPS in future requests. You could use Cookie Secure flag that from now on only send cookies over HTTPS. You could use DNS based redirect but only ...
2
votes
1answer
83 views

HSTS Cache Policy for Root Domain

Let's imagine my main website is https://www.example.com, but a user types in http://www.example.com. Should this redirect straight to https://www.example.com, or should it first redirect to https://...
3
votes
3answers
492 views

Upgrade-Insecure-Requests as an alternative for HSTS

I have seen that websites automatically transform HTTP requests into HTTPS without the HTTP Strict Transport Security (HSTS) Header. So does the following line in the request fully alleviate the ...
2
votes
1answer
92 views

Why wouldn't you institute Strict-Transport-Security headers?

I read recently that HSTS can cause problems with site access. Under what circumstances might that happen and what are safe HSTS settings to implement on my web server?
-1
votes
1answer
477 views

How does browsers detects HSTS sites?

I have come across scenarios where we introduce a proxy which does SSL decryption and it fails on HSTS sites, e.g. Facebook, Gmail, etc. In a MITM proxy setup the Facebook page will be signed by the ...
4
votes
2answers
1k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
5
votes
1answer
490 views

What is the implication of HSTS on unsupported browsers?

HSTS is currently available only on Edge and IE11. What will be its implication on lower browser versions (IE9 & IE10)? How will HSTS behave? Will there be any impact on the site?
1
vote
1answer
100 views

Can the subdomains have different certificates from the main domain if I use HSTS includeSubDomains and preload?

I have a main domain where I serve my website, and then I have subdomains that I use to deploy other projects which may be temporary. Having set up a deployment system with docker and letsencrypt, ...
-1
votes
2answers
2k views

Chrome and Firefox showing errors even after importing latest CA certificate for Burp Suite

I am using Chrome 61.0.3163.100 and Firefox 39 on Windows 7 32-bit with Burp Suite v1.7. I have imported latest CA certificate for Burp Suite. In spite of which it's not working for sites with HSTS ...
4
votes
1answer
1k views

SSLStrip2 and HSTS

I have a question concerning the usage of SSLstrip2 to bypass HSTS on websites. I managed to successfully install and deploy SSLStrip2 (in combination with DNS2Proxy). This means that when using a ...
0
votes
0answers
85 views

Mitf SSLStrip2 Can HSTS still be Bypassed [duplicate]

So back in 2015 there was a lot of talk about a method in which HSTS could be bypassed. Basically here is the method: Most people type a url without adding http:// or https:// or simply click a link ...
1
vote
1answer
96 views

How to include HSTS policy in dns replies packet

I want to protect the clients from sslstrip attack. HSTS should be used. But HSTS does not protect the first visit of the client to the server. So I want to include HSTS policy in dns replies and send ...
2
votes
0answers
59 views

Current HSTS set not displaying visited sites

I'm using chrome://net-internals/#hsts to do HSTS testing. I tried to query a domain that has HST preloaded (facebook.com), and got the expected results: Found: static_sts_domain: facebook.com ...
25
votes
2answers
3k views

Do I have a current MITM?

I apologise for to terseness of this question; I have an issue. Google.co.uk is failing its HSTS on my browsers. Is this an issue with google.co.uk or is this just me? Is someone middle-manning my ...
-1
votes
2answers
294 views

Can I use HSTS with mixed HTTP/HTTPS subdomains?

If I have a secure https://www.foo.com domain, but also have insecure http://a.foo.com and http://b.foo.com domains, is it possible to use an HSTS header with the includeSubDomains option if you only ...
0
votes
0answers
161 views

Self signed certificate installed on Android, still unable to access websites with HSTS

I have created a self-signed certificate with openssl. It is being served from my proxy (squid). I installed the same certificate on an Android phone as a trusted certificate. I connect to a VPN (and ...
110
votes
7answers
22k views

Why should I offer HTTP in addition to HTTPS?

I am setting up a new webserver. In addition to TLS/HTTPS, I'm considering implementing Strict-Transport-Security and other HTTPS-enforcement mechanisms. These all seem to be based on the assumption ...
0
votes
1answer
255 views

Is my DNS being poisoned?

Today I was greeted by this error in Firefox: It was happening consistently for a minute or two, and reverted back to normal. I confirmed that it happens on another browser and that other HTTPS sites ...
1
vote
1answer
98 views

HSTS Implementation and response type

I have implemented the HSTS in my ASP.Net MVC based Website. But if I make a HTTP(not HTTPS) request, the request is propagating using the HTTP channel and the response is 301: Moved Permanently. And ...
2
votes
2answers
864 views

Is HSTS Header Helpful For Mobile Applications?

I'm using HSTS(Strict-Transport-Security Header) for web applications. As far as I know browser keeps that information and when a user tries to connect to my website, browser loads it via HTTPS ...
3
votes
2answers
483 views

What is HPKP and how does it work in case of websites

I was looking at HTTP Strict Transport Security (HSTS) implementation in firefox. Firefox stores this data for sites in a file called SiteSecurityServiceState.txt I see entries in it like - ...
1
vote
3answers
379 views

HSTS preventing MiTM cookie hijacking attacks

I was watching the following presentation: https://www.youtube.com/watch?v=jYcx7WtbB0A It addressed the issue when trying to access a particular web site that is available over both HTTP and HTTS ...
0
votes
0answers
827 views

ERR_SSL_PROTOCOL_ERROR on a site that doesn't use SSL/TLS, on an odd port

I've set up a server running Jenkins. The web-interface doesn't have SSL/TLS support turned on by default, and I have not attempted to turn it on, and do not want to turn it on (for now at least). ...
1
vote
1answer
138 views

HSTS implemented but not working?

While being connected on a very restricted network, I was only able to access the internet through a Squid proxy which was configured only for HTTP on port 80. When navigating to google.com, I'm able ...
0
votes
2answers
297 views

If I install Burp certificate in my system and try to access HSTS certified site and site will work and is it safe?

Can I intercept request via burp suite CA certificate for HSTS sites and is it safe or not?
2
votes
1answer
667 views

Securing a Web application using HSTS

Background I am developing a Web application using ASP.Net MVC. I deployed the application in IIS(V8) and now doing the Web app hardening process. I configured the SSL in IIS and the Web app is ...
3
votes
2answers
1k views

Is Strict-Transport-Security header necessary when HTTPS is set up? [duplicate]

My website data is transferred via HTTPS. As far as I understand this, there is a certificate that is issued by CA which is provided by server for each client, client and server decide how to encrypt ...