sus.botdocs

Security finding

The HSTS policy says one thing and the hosts, links or headers say another

Security Warning Severity: Medium

Part of the audit HSTS promises HTTPS everywhere, the site does not deliver it. Finding id: security.hstsVsReality.

What it costs you

The policy promises HTTPS everywhere and the site does not deliver it. Where the promise is stricter than the site, visitors get a browser error they cannot click past. Where it is looser, first visits still start unencrypted.

What to do

Decide what the policy should be, then make hosts, links and header match it. Send the preload token only when you meet every preload requirement and mean it: removal takes months.

What it checks

  • Preload requested but requirements not met
  • HSTS on some hosts only
  • HTTP links and files despite HSTS
  • HSTS sent over unsecured HTTP

How to fix it

Fix

    Remove the preload token or meet every requirement

    1. To step back: remove the word preload from the Strict-Transport-Security header.
    2. To go ahead: serve a valid certificate, redirect HTTP to HTTPS on the same host, serve every subdomain over HTTPS, and send max-age of at least 31536000 with includeSubDomains and preload.

    How to check: curl -sI https://[host]/ | grep -i strict-transport-security

    Send the same HSTS header on every host

    1. Find where [detail] gets its Strict-Transport-Security header and send the same header from [host].

    How to check: curl -sI https://[host]/ | grep -i strict-transport-security

    Change http addresses to https

    1. Change [detail] and addresses like it to https:// where they are written: template, content or script.

    How to check: Recrawl: no internal link or file address starts with http://.

    Make the HTTP address redirect only

    1. Make http://[host]/ answer every request with a 301 to HTTPS and nothing else.
    2. Send Strict-Transport-Security on HTTPS responses only.

    How to check: curl -sI http://[host]/ | grep -i -E 'HTTP/|location|strict-transport-security' (expect 301, a Location, and no HSTS line)

    Thresholds

    Thresholds for The HSTS policy says one thing and the hosts, links or headers say another
    NameDefaultMeaning
    preload_min_max_age31536000Shortest max-age the browser preload list accepts, in seconds. hstspreload.org asks for at least 31536000 (one year).

    How to verify by hand

    Browser errors reported by users; the preload list status.

    What this relies on

    The policy states the intent; a forgotten subdomain breaks it.