Hot answers tagged

164

For usability reasons you need to offer a redirect to HTTPS from all HTTP URL:s. Otherwise first time visitors who simply enter example.com/some/page into the URL bar of the browser will be greeted by a connection error. Serving the redirect does not make you more vulnerable. Users who don't have your HSTS entry in their browsers will make a HTTP request ...


69

Why don't I just serve https only? The main reasons are the default behavior of browsers and backward compatibility. Default behavior When an end-user (i.e, without knowledge in protocols or security) types the website address in its browser, the browser uses by default HTTP. See this question for more information about why browsers are choosing this ...


55

Let's look at the scenario with a 301 redirect first. The victim sends a request to http://example.com (as pointed out in comments, this could because of SSLStrip or because the user just entered example.com in the URL bar and browsers default to HTTP). If there is no MitM attack they get a 301 response back, and is redirected to https://example.com. But if ...


47

Yes, you should activate HSTS. HTTPS without HSTS is significantly weaker since it makes your users vulnerable to downgrade attacks. Sending a HSTS header guarantees that users will directly connect to your website over SSL after their very first visit (trust-on-first-use) and until the specified timeout is reached. The choice whether to activate HSTS or ...


41

HTTP Strict Transport Security (HSTS) is designed for security. HTTP 301 Moved Permanently is used for URL redirection. The 301 redirect is an important part of deploying an HTTPS website. As part of the HTTP protocol, it is supported by more browsers than HSTS. It serves as the primary means for upgrading a plaintext connection to HTTPS, updating search ...


40

Your browser rejected a certificate, but this doesn't have to be caused by an attack. Google.co.uk is failing its HSTS on my browsers. The warning you see doesn't indicate a problem with HSTS in particular. It's just Firefox saying: "The certificate appears invalid. And by the way, we won't let you add a manual exception because the site uses HSTS." 1 ...


33

I suggest you look into NeverSSL, a simple site which will always be served over plain HTTP. If you are sure it is your browser doing it and not a redirect on the server side, it is likely the result of a security feature called HTTP Strict Transport Security (HSTS). When a website wants to only serve over an encrypted connection, it sets an HTTP header ...


32

Based on the RFC, HTTP Strict Transport Security (HSTS), the includeSubDomains states: 6.1.2. The includeSubDomains Directive The OPTIONAL "includeSubDomains" directive is a valueless directive which, if present (i.e., it is "asserted"), signals the UA that the HSTS Policy applies to this HSTS Host as well as any subdomains of the ...


28

Chrome: Open Chrome Type chrome://net-internals/#hsts in the address bar of chrome Query domain: if it appears as a result, it is HSTS-enabled Firefox: Open file explorer Copy and paste %APPDATA%\Mozilla\Firefox\Profiles\ into the address bar of the file explorer (for Linux it is ~/.mozilla/firefox; for Mac, it is ~/Library/Application Support/Firefox/...


26

This client behavior is prohibited by section 8.1 of the RFC: If an HTTP response is received over insecure transport, the UA MUST ignore any present STS header field(s). The spec prohibits severs from sending insecure HSTS directives and clients from processing insecure HSTS directives. This ensures that a faulty implementation in either a server or ...


25

Secure cookies can be set over insecure channels (e.g. HTTP) as per section 4.1.2.5 of RFC 6265. It explicitly mentions that the Secure flag only provides confidentiality and not integrity, as a Secure flagged cookie can still be set from an insecure channel, overwriting any previously set value (via a secure channel or otherwise): The Secure attribute ...


22

You can't. The best you can do is to use SSL sitewide. Have all HTTP connections immediately redirect the user over to HTTPS (redirect over to the front page via HTTPS, e.g., http://www.example.com/anything.html should redirect to https://www.example.com/). Don't serve any content over HTTP (other than an immediate redirect to your front page, over HTTPS)....


22

Yes, strict transport security provides a real benefit. HSTS tells the browser to only communicate with the server via HTTPS. The first time the browser sees the HSTS header from the server, it remembers it. When the user visits the site again, the browser enforces that all communication is done via HTTPS. This will work as long as the attacker doesn't ...


21

According to several forums, you can disable HSTS by introducing a new configuration variable. First, go to the Firefox configuration page (about:config), right-click, choose "New Integer", then provide the name "test.currentTimeOffsetSeconds" (no quotes) with a value of 11491200. This should bypass HSTS, although you may also need to clear the Cache and ...


21

Subdomains can often be used for different purposes, and as a result they can be using different web applications possibly hosted on different equipment. Not every website on every subdomain needs to follow the policy of the domain, it can even be the case that sites on subdomains do not support HTTPS due to lack of support in the application and/or not ...


20

The up-voted answers are very good. You'll sacrifice usability without a major impact on security if you completely shut off HTTP. However, you can mitigate that with the HSTS Preload option. Preloading your website means you register your domain with the browser vendors and they'll hard-code their browsers to visit your website via HTTPS only. That means ...


19

Type about:support in firefox Click show in folder which should open your profile folder. Find file called SiteSecurityServiceState.txt and open it Find the entry for your site url and remove it. Entry would looks something like - github.com:HSTS 120 17242 1521194647604,1,1 Make sure for above firefox is closed so that it does not overwrite it. Firefox ...


18

The HSTS header stops MitM attacks by instructing the browser to always send HTTPS (as opposed to HTTP) request to the domain until the policy expires. So a browser that respects the header would send a request to https://example.com even if the user clicked a link to http://example.com. The logic behind HSTS has not changed since it was defined in an RFC ...


17

In summary of the comments (and by replacing my previous answer): as long as sslstrip is possible the attacker can impersonate the user and control the session while the browser thinks that the user controls the session. Only HSTS can prevent sslstrip and only HSTS preload can prevent sslstrip on the first request (before getting a HSTS header). Thus HSTS ...


16

It's best to let the site owner decide whether subdomains are affected, just as the site owner decides whether to use HSTS at all. The extra flexibility could help improve HSTS adoption by reducing compatibility obstacles. Some of the subdomain services may not have an HTTPS server installed yet. There are a few cases where it's not important security-wise ...


15

Yes, if you are using SSL sitewide, then I definitely recommend enabling HSTS. HSTS is an important security measure to defeat man-in-the-middle attacks that shift the user over to http and then attack the user. For instance, sslstrip is a well-known tool to mount such an attack. For more details on this sort of attack, see the following questions: How to ...


15

Your browser doesn't apply the HSTS policy of test.example.com because it hasn't seen the header before over error-free secure transport. Therefore, it still allows you to "add an exception". The user agent processing model [...] stipulates that a host is initially noted as a Known HSTS Host, or that updates are made to a Known HSTS Host's ...


14

HSTS only forces a site to use HTTPS. This prevents downgrade attacks such as SSLstrip from being effective. As HSTS says nothing about the certificate that will be used, it has no effect when you renew your certificate. (Note that the certificate will still need to pass all standard validity checks.) HTTP public key pinning, a related technology, is used ...


14

Submit your website to the HSTS preload list. The HSTS preload list is a list of hostnames embedded in browsers, allowing them to know which websites must be crawled as HTTPS only, thus preventing any non-HTTPS request.


13

If either of the static_upgrade_mode: or the dynamic_upgrade_mode: lines are set to STRICT then HSTS is enabled. Dynamic Dynamic means that the browser has been instructed to enable HSTS by an HTTP response header (served over TLS) similar to the following: Strict-Transport-Security: max-age=157680000; includeSubDomains; This is vulnerable to an attack ...


13

Edit: Facebook now use HSTS, so both question and answer are now incorrect. Because using HTTPS for Facebook is optional. If you look in "Account Settings" and "Security Settings" there is an option for "Secure browsing". It has defaulted to on since July 2013 but you still have the option to turn it off. If they used HSTS then when you turned off "Secure ...


13

HSTS headers sent over HTTP are ignored by specification compliant browsers - this is to prevent a man-in-the-middle from causing visitors to be unable to access a non-HTTPS website by setting a HSTS rule in the browser. (see RFC 6797) Therefore, you can safely, although technically incorrectly, serve HSTS headers to all your users, and provide the same ...


11

HSTS is enabled by returning the strict-transport-security header from a HTTPS response - the browser does not care whether this is set in PHP, by the server, or by a load balancer - as long as it receives a valid header over HTTPS then HSTS will be enabled. You should be OK only returning this header from a single page for testing too. RFC 6797 states ...


11

Summary: HSTS is coming, but the site has some hurdles related to protecting user information such as not telling a website who you are when you click on a link. Explanation of that particular issue: https://www.facebook.com/notes/facebook-engineering/protecting-privacy-with-referrers/392382738919 Firefox is the last major holdout. Here's comment 14 (March ...


Only top voted, non community-wiki answers of a minimum length are eligible