HTTP Strict Transport Security
lastmod 2024-11-06created 2020-01-174 edits
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should interact with it using only HTTPS connections, which provide Transport Layer Security (TLS/SSL), unlike the insecure HTTP protocol used alone. HSTS is an IETF standards track protocol and is specified in RFC 6797.
HSTS (HTTP Strict Transport Security) is one of the policies that supplement HTTPS, and it can force users' secure (HTTPS) connections for a set period of time.
About
| WARNING |
| Sourced from Namuwiki. Read with a critical eye. |
In computer security, whether a web-based system that applies secure connections (HTTPS) can always maintain secure connections is a perennial issue. To solve this issue, you would have to check every case: checking the protocol (plain HTTP or HTTPS) every time during development, blocking access for users who are not on a secure connection, and the use of forged certificates or similar illegitimate methods[1]. In practice, this is impossible when running a service.
One of the concepts that came out of this is HSTS. HSTS can force HTTPS connections to a specific domain outright for a set period of time, so if a plain HTTP connection is attempted while navigating between pages, the protocol is forcibly changed to HTTPS.[2] Because it is a standardized procedure, it is compatible with a wide range of web browsers and devices. (Microsoft Edge, Internet Explorer, Chrome, Firefox, Safari, Opera, other mobile web browsers, etc.)
If you register a site on the HSTS Preload List led by Google Chrome, after a browser update that domain will semi-permanently connect over HTTPS without exception. Not only Chrome but also many other browsers such as Edge, Safari, and Firefox support it and use the same DB. If you enter a domain on that site, you can see whether the site is registered on the Preload List or whether it is eligible for registration. Once a site is registered on the list, browsers updated afterward will always connect to the registered domain over HTTPS, and if HTTPS is not supported, the connection itself becomes impossible.[3] Even if you request removal of the domain from the list, it follows the browser update cycle just like registration, so you should be careful from the start. You should not register unless there is a guarantee that, in the long term, you can support HTTPS on every page of the site, including subdomains.
If you use the CDN from Cloudflare, you can apply the HSTS option in the settings. If you are not using Cloudflare, just add the Strict-Transport-Security header directly in the web server settings. Basically, to register a site on the Preload List, the max-age of Strict-Transport-Security must be at least 1 year (31536000), subdomains must be included (includeSubDomains), the preload option must be present, and HTTP connections must 301-redirect to HTTPS.
Supercookie
| WARNING |
| Sourced from Namuwiki. Read with a critical eye. |
HSTS is a concept introduced to improve security, but it was once controversial when the concept of a 'supercookie' using HSTS became known. This is because recording domain information somewhere in order to force HTTPS connections to a specific domain risks being abused as a tool for tracking the websites a user visits. In fact, in PC browsers the setting is reset only when all cache files stored in the web browser are deleted, and in non-PC embedded browsers there may be no way to delete it at all.
Because it may remain forever unless the user takes great care to delete it, the so-called 'supercookie' baked by HSTS has led every web browser developer, including Google, Apple, MS, and Mozilla, to add legal disclaimers. In fact, if you report a web browser security vulnerability or software bug related to HSTS, you are more likely to get the disclaimer in the terms of service as a reply than an opinion on the report itself.
Among similar concepts, if HSTS is the domain version, HPKP is the certificate version, and HPKP also carries the main concerns of HSTS as is.
However, on January 26, Mozilla Firefox applied an update that prevents tracking through supercookies.
Chrome settings
In Chrome, go to chrome://net-internals/. See Chrome#List of special pages (Special pages) for details.