HTTP Strict Transport Security (commonly referred to as HSTS) is an opt-in browser security mechanism that lets web site owners declare “Encrypted Communications Only”. The Strict-Transport-Security HTTP header instructs browsers to only communicate with the domain over SSL/TLS for a set period of time (the max-age). HSTS only goes into effect after a browser receives a valid header from the domain. The goal of HSTS is to ensure unencrypted communication is not allowed on your site to mitigate attacks such as SSL-stripping.
The HSTS Header
The max-age parameter value is in seconds; 31536000 seconds equals 365 days. Notice how the above also uses includeSubDomains. This optional parameter informs the browser to force secure communication to the site’s subdomains as well.
Browsers must receive the Strict-Transport-Security header over an HTTPS connection with the domain; HSTS headers over HTTP are not recognized as valid.
HSTS mitigates the following threats.
1. HTTP request to an HTTPS site
- User wants to visit SecureSite.com
- User types SecureSite.com into the address bar
- Browser automatically appends “http://” making the following request: http://SecureSite.com
- Server responds with 301 (permanent redirect) to the following location: https://SecureSite.com
- Browser makes request to above URL
The above scenario allows for a man-in-the-middle attack as a result of the unintentional HTTP request to SecureSite.com. An attacker can leverage a tool such as ssltrip to transparently hijack the HTTP request prior to the 301 redirect. HSTS eliminates this attack window as long as the user previously accessed SecureSite.com over HTTPS and obtained the HSTS header.
Even with HSTS enabled, a user’s initial request to SecureSite.com would remain unprotected from attacks. As a result, both Chrome and Mozilla introduced HSTS preload lists. If SecureSite.com is on Chrome’s HSTS preload list, a freshly installed Chrome browser will only allow secure connections to that site, even if the user never accessed it before.
2. Insecure link referencing an HSTS enabled site
- Forum.com includes a link to http ://SecureSite.com
- HSTS will automatically convert the link to HTTPS for the HSTS-enabled site
3. Invalid Certificate
The following would be considered invalid certificates:
- Self-signed and/or untrusted CA signed certificate
- Wrong name specified
HSTS displays an error message as shown below. In addition, it will NOT allow the user to override the error message, thus preventing a potential attack by ensuring the victim does not accept the bad certificate.
Creating an invalid certificate with Burp Suite for nVisium.com
- Chrome / Firefox / Opera all support HSTS as far back as 3 (or three) versions
- Safari 7.0 supports HSTS
- IE 11 and older do NOT support HSTS
- IE 12 will support HSTS ( https://threatpost.com/ie-12-to-support-hsts-encryption-protocol/105266)
See http://caniuse.com/stricttransportsecurity for a full browser compatibility table
You can enable HSTS in Apache with mod headers and the following line in your configuration:
Afterwards, restart Apache and test the configuration change:
In Nginx, update nginx.conf:
In Rails, HSTS can be enabled with the following:
Alternatively, you can also leverage the secure_headers gem with your Rails web app to send an HSTS header.
HSTS Preload Lists
Email Adam Langley to get added to the list:
Update : You no longer have to update Adam. Add your site using using the following:
Firefox does not maintain their own list; instead, they use a subset of Google’s. Firefox only accepts sites on Google’s preload list that have a max-age greater than or equal to 18 weeks (10886400 seconds). See https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ for more information.
Preload List Adoption
The below diagram shows the total number of Preload sites from April 2012 to April 2014:
There was an 84% increase from 2013 to 2014.
Leverage an intercepting proxy (e.g. Burp) or browser tools (e.g. Chrome DevTools / Firefox Developer Tools) to examine server responses
In Chrome, type the below to determine if a host is in your STS cache
In Firefox, you can use the Strict Transport Security Detector add-on to see if the site supports HSTS ( https://addons.mozilla.org/en-US/firefox/addon/strict-transport-security-d/)