Hello comrade,
everybody knows about HSTS - HTTP Strict Transport Security. It is a web security mechanism that is widely used to protect users from protocol downgrade attacks or cookie hijacking.
Works pretty simple:
But are you paranoid enough? What happens during the very first request to your website, if it is going through HTTP? The client's browser knows nothing about HSTS settings on server's side, thus he is vulnerable.
Solution: HSTS preload. Supported by most major browsers, this technique uses the list, which is built in the browser (just like PKI certificate authorities). If your site is in this list, then the client will use only secured connection to reach it. Important to remember, that HSTS preload affects all subdomains as well (!).
To enable HSTS preload to your website, go to https://hstspreload.appspot.com . There enter your website and follow the instructions. Most likely you will have to modify your HSTS header and make it look like this:
Be paranoid.
everybody knows about HSTS - HTTP Strict Transport Security. It is a web security mechanism that is widely used to protect users from protocol downgrade attacks or cookie hijacking.
Works pretty simple:
- Servers sends the header Strict-Transport-Security with the max-age parameter.
- Client (browser) sees the header and if it is supported - transforms all insecure links referencing the application into secured. This behavior for this site will be used for the next max-age seconds.
But are you paranoid enough? What happens during the very first request to your website, if it is going through HTTP? The client's browser knows nothing about HSTS settings on server's side, thus he is vulnerable.
Solution: HSTS preload. Supported by most major browsers, this technique uses the list, which is built in the browser (just like PKI certificate authorities). If your site is in this list, then the client will use only secured connection to reach it. Important to remember, that HSTS preload affects all subdomains as well (!).
To enable HSTS preload to your website, go to https://hstspreload.appspot.com . There enter your website and follow the instructions. Most likely you will have to modify your HSTS header and make it look like this:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Be paranoid.
No comments:
Post a Comment