Skip to main content
159 votes

Why should I offer HTTP in addition to HTTPS?

For usability reasons you need to offer a redirect to HTTPS from all HTTP URL:s. Otherwise first time visitors who simply enter example.com/some/page into the URL bar of the browser will be greeted by ...
Anders's user avatar
  • 65.7k
72 votes

What's the difference between using HSTS and doing a 301 redirection?

Let's look at the scenario with a 301 redirect first. The victim sends a request to http://example.com (as pointed out in comments, this could because of SSLStrip or because the user just entered ...
Anders's user avatar
  • 65.7k
69 votes
Accepted

Why should I offer HTTP in addition to HTTPS?

Why don't I just serve https only? The main reasons are the default behavior of browsers and backward compatibility. Default behavior When an end-user (i.e, without knowledge in protocols or ...
Ronny's user avatar
  • 1,088
51 votes

What's the difference between using HSTS and doing a 301 redirection?

HTTP Strict Transport Security (HSTS) is designed for security. HTTP 301 Moved Permanently is used for URL redirection. The 301 redirect is an important part of deploying an HTTPS website. As part of ...
bonsaiviking's user avatar
  • 11.7k
47 votes
Accepted

Should I activate HSTS with Let’s Encrypt Certificates?

Yes, you should activate HSTS. HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect ...
Arminius's user avatar
  • 45k
44 votes

Can HSTS be disabled in Firefox?

Type about:support in firefox Click Profile Folder | Open Folder which should open your profile folder. Find file called SiteSecurityServiceState.txt and open it Find the entry for your site url and ...
Aniket Thakur's user avatar
39 votes
Accepted

Do I have a current MITM?

Your browser rejected a certificate, but this doesn't have to be caused by an attack. Google.co.uk is failing its HSTS on my browsers. The warning you see doesn't indicate a problem with HSTS in ...
Arminius's user avatar
  • 45k
37 votes
Accepted

Is there any point in having the HSTS header enabled when using HTTP/2?

Yes, HSTS is still needed, including HSTS preload. The way a browser connects to HTTP/2 is through a URL that looks exactly the same as the URL for HTTP/1, so it doesn't know that it must be HTTP/2 ...
Z.T.'s user avatar
  • 8,544
33 votes

Security benefit of browsers automatically rewriting HTTP to HTTPS?

I suggest you look into NeverSSL, a simple site which will always be served over plain HTTP. If you are sure it is your browser doing it and not a redirect on the server side, it is likely the result ...
forest's user avatar
  • 67k
30 votes

Can HSTS be disabled in Firefox?

I was able to disable it by setting network.stricttransportsecurity.preloadlist to false in about:config Then, to see the add exception button you may need to refresh the cache doing the 5 steps ...
Tobia's user avatar
  • 495
28 votes

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

Secure cookies can be set over insecure channels (e.g. HTTP) as per section 4.1.2.5 of RFC 6265. It explicitly mentions that the Secure flag only provides confidentiality and not integrity, as a ...
Polynomial's user avatar
  • 135k
27 votes
Accepted

"google.com" is not HSTS protected?

Current situation It is true that, as of Oct 2020, Google does not have HSTS on google.com, but only on www.google.com, and performs redirection first to www and then to https://. Even if there was a ...
Esa Jokinen's user avatar
  • 19.1k
27 votes

Do subdomains of a TLD with mandatory HTTPS require a wildcard certificate?

Many new TLDs have mandatory HTTPS requirements. Is there a way to disable that for subdomains? No. Mandatory means that TLS is not only required for the "bare" domain but also for the ...
Steffen Ullrich's user avatar
21 votes
Accepted

May HSTS block access to your site when you renew your SSL certificate?

HSTS only forces a site to use HTTPS. This prevents downgrade attacks such as SSLstrip from being effective. As HSTS says nothing about the certificate that will be used, it has no effect when you ...
Neil Smithline's user avatar
21 votes

Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?

Subdomains can often be used for different purposes, and as a result they can be using different web applications possibly hosted on different equipment. Not every website on every subdomain needs ...
Teun Vink's user avatar
  • 6,938
20 votes

Why should I offer HTTP in addition to HTTPS?

The up-voted answers are very good. You'll sacrifice usability without a major impact on security if you completely shut off HTTP. However, you can mitigate that with the HSTS Preload option. ...
Taul's user avatar
  • 599
18 votes
Accepted

How does HSTS stop MitM attacks?

The HSTS header stops MitM attacks by instructing the browser to always send HTTPS (as opposed to HTTP) request to the domain until the policy expires. So a browser that respects the header would send ...
Anders's user avatar
  • 65.7k
17 votes
Accepted

How do you prevent sending cookie data over HTTP the first time?

In summary of the comments (and by replacing my previous answer): as long as sslstrip is possible the attacker can impersonate the user and control the session while the browser thinks that the user ...
Steffen Ullrich's user avatar
17 votes
Accepted

Does HSTS protect against a rogue CA issuing a illegitimate valid certificate?

No, HSTS does not protect against certificate misissuance. HSTS simply tells the browser to only allow connecting to that site over HTTPS, it doesn't have anything to do with checking whether the ...
AndrolGenhald's user avatar
16 votes

Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?

It's best to let the site owner decide whether subdomains are affected, just as the site owner decides whether to use HSTS at all. The extra flexibility could help improve HSTS adoption by reducing ...
700 Software's user avatar
15 votes
Accepted

HSTS: Clicking through certificate errors

Your browser doesn't apply the HSTS policy of test.example.com because it hasn't seen the header before over error-free secure transport. Therefore, it still allows you to "add an exception"....
Arminius's user avatar
  • 45k
15 votes

Do subdomains of a TLD with mandatory HTTPS require a wildcard certificate?

A single certificate can cover a large number of domains through the Subject Alternative Name (SAN) extension. The maximum number may vary between different CAs, but Let's Encrypt supports up to 100 ...
Ja1024's user avatar
  • 12.4k
14 votes

How do you prevent sending cookie data over HTTP the first time?

Submit your website to the HSTS preload list. The HSTS preload list is a list of hostnames embedded in browsers, allowing them to know which websites must be crawled as HTTPS only, thus preventing ...
Benoit Esnard's user avatar
13 votes

What's the difference between using HSTS and doing a 301 redirection?

First of all, some old browsers don't support HSTS, so you still need to redirect HTTP to HTTPS, set the secure flag on all cookies, etc. Now, with that said... In addition to the fine reasons listed ...
CBHacking's user avatar
  • 49.7k
11 votes
Accepted

Upgrade-Insecure-Requests as an alternative for HSTS

From MDN: The upgrade-insecure-requests directive will not ensure that users visiting your site via links on third-party sites will be upgraded to HTTPS for the top-level navigation and thus ...
IamNaN's user avatar
  • 742
11 votes
Accepted

How do browsers get HSTS preload data?

The entire list is shipped with the browser (atleast for chrome). This is made clear on hstspreload.org: This is a list of sites that are hardcoded into Chrome as being HTTPS only. (emphasis mine) ...
nobody's user avatar
  • 11.6k
10 votes
Accepted

HTTP not being converted to HTTPS with HSTS

To cite from the source code you mention: 354 // Other Google-related domains that must use an acceptable certificate 355 // iff using SSL. ... 361 { "name": "doubleclick.net", "...
Steffen Ullrich's user avatar
9 votes
Accepted

If I'm using HSTS, can I skip the scheme from my CSP directives?

You can safely omit the scheme if the page which sets the CSP header is loaded via HTTPS. Without an explicit scheme, the scheme of the origin is assumed (it doesn't mean that the scheme can be ...
Ja1024's user avatar
  • 12.4k
8 votes
Accepted

How to see when a HSTS domain is about to expire?

HSTS data is kept by each web browser. When a request is made to a domain that implements HSTS, the response headers will contain a Strict-Transport-Security header that notes the maximum age of the ...
user's user avatar
  • 7,805
8 votes

How does HSTS stop MitM attacks?

SSLStrip worked rewriting https requests to plain http, removing the protection and allowing both eavesdropping and modification. A server with HSTS protection will set a header on a HTTPS request ...
ThoriumBR's user avatar
  • 54.6k

Only top scored, non community-wiki answers of a minimum length are eligible