HTTP Strict Transport Security (hsts)

Just learned about HSTS and started using it. First let me explain HSTS with my own words.

Scenario without hsts:

1. The user types the domain name in the URL bar without the protocol, such as “example.com”, and the browser automatically adds the “http://” prefix. This first request is vulnerable to Man In The Middle (MITM) attacks.
2. The server replies with a redirection to the secure “https://example.com”. From the rest of the interaction communication is secure.
3. The next day the user types again “example.com” in the URL bar. The browser sends again an insecure HTTP request.

Scenario with hsts:

1. The user types the domain name in the URL bar without the protocol, such as “example.com”, and the browser automatically adds the “http://” prefix. This first request is vulnerable to Man In The Middle (MITM) attacks.
2. The server replies with a redirection to the secure “https://example.com”. From the rest of the interaction communication is secure. And, the server adds the response header:

   Strict-Transport-Security: max-age=31536000

   This response header instructs the browser to use HTTPS, and asks him to do so for the next 31.536.000 seconds (1 year).

3. The next day, the user types again “example.com” in the URL bar. But, the browser remembers, and it uses HTTPS instead of HTTP. And will do so even if the user includes explicitly the prefix “http://example.com”.

Closing

So with HSTS the user will only be vulnerable the first time, and not every time she starts a session.

After learning this I have added support for HSTS to my Ansible role for Django deployment. See commit, and I encourage you to start using HSTS too.

Links:

• Details on HSTS and Nginx (must read if using Nginx)
• Report on HSTS by Netcraft

Have a nice secure day!