HSTS Abraham Martin (@abraham_martinc) University of Cambridge 

HTTP Strict Transport Security RFC 6797 November 2012 

Browser Bank web server http://bank.com …… https://bank.com/login.html” Cookies! (Session) HTTP HTTPS 

Browser Man in the middle http://bank.com …… https://benk.com/login.html” Certificate is valid!… …for benk.com Also, an attacker could get the cookies/session HTTP HTTPS 

You could think… Ok, I’m secure because I have my web server configured to redirect all http calls to https. 

Browser http://bank.com HTTP 302 Redirect to https://bank.com https://bank.com/ HTTP HTTPS Bank web server 

Configuring your web server to always redirect to HTTPS does NOT solves the problem 

Browser Man in the middle http://bank.com HTTP 302 Redirect to https://benk.com https://benk.com/ Certificate is valid!… …for benk.com HTTP HTTPS 

HTTP Strict Transport Security to the rescue 

Browser http://bank.com …… https://bank.com/login.html” Header: Strict-Transport-Security Browser saves this sites as STS HTTP HTTPS Bank web server 

Browser http://bank.com HTTP 302 Redirect to https://bank.com https://bank.com/ HTTP HTTPS Header: Strict-Transport-Security Browser saves this sites as STS Bank web server 

Next time the user writes in their browser http://bank.com or bank.com 

Browser http://bank.com https://bank.com Impossible man in the middle attack HTTP HTTPS Bank web server 

Header always set Strict-Transport-Security "max- age=63072000; includeSubDomains" 

http://caniuse.com/