HSTS i HTTPS redirect: Razlika između sigurnog i nesigurnog prelaska

← Blog

Problem sa običnim HTTPS redirectom

Scenario: korisnik kuca vasafirma.rs u browser. Browser automatski šalje HTTP zahtev:

GET http://vasafirma.rs/ HTTP/1.1

Server odgovara sa 301 redirect na HTTPS. Browser prati redirect i uspostavlja bezbednu vezu.

Problem: Taj prvi HTTP zahtev je nešifrovan. Napadač koji vrši Man-in-the-Middle napad na istoj mreži (coffee shop, hotel, aerodrom) može presresti i izmeniti taj začetni HTTP odgovor — i umesto redirecta na HTTPS, preusmeriti korisnika na lažni sajt ili čak skinuti HTTPS protection (SSL stripping napad).

Šta je HSTS?

HTTP Strict Transport Security (HSTS) je mehanizam koji instruiše browser da za svaki budući zahtev ka ovom domenu automatski koristi HTTPS — na strani browsera, pre nego što se išta pošalje.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Kako funkcioniše

1. Browser po prvi put poseti sajt i dobije HSTS header
2. Browser zapisuje: "za vasafirma.rs, uvek koristi HTTPS, sledeća 31536000 sekundi (1 godina)"
3. Sledeći put korisnik kuca http://vasafirma.rs, browser ga sam konvertuje u HTTPS pre slanja zahteva
4. Nema inicijalnog HTTP zahteva, nema mogućnosti za SSL stripping

Parametri

• max-age=31536000 — koliko sekundi browser pamti instrukciju (1 godina je preporuka)
• includeSubDomains — proteže i sve subdomene (api.vasafirma.rs, mail.vasafirma.rs)
• preload — dozvoljava uvrštavanje na browser preload listu

HSTS Preload lista

HSTS header štiti od drugog posjeta nadalje, ali šta je sa prvim? Preload lista rešava i to: browseri (Chrome, Firefox, Safari, Edge) dolaze sa hard-coded listom domena koji uvek koriste HTTPS — čak i pre prvog zahteva. Možete dodati svoj domen na hstspreload.org.

SSL Stripping napad

SSLstrip (2009, Moxie Marlinspike) je demonstrirao kako napadač na MITM poziciji može:

1. Presresti inicijalni HTTP zahtev
2. Uspostaviti HTTPS vezu sa serverom u svoje ime
3. Servirati korisniku HTTP verziju sajta (sa HTTP linkovima)
4. Korisnik ne vidi lockicu, a sav saobraćaj prolazi kroz napadača

HSTS u kombinaciji sa preload listom čini ovaj napad neefikasnim jer browser odbija HTTP komunikaciju i pre slanja zahteva.

Šta proveriti

• Da li postoji HTTPS redirect za HTTP?
• Da li redirect ide direktno na HTTPS ili kroz više hop-ova?
• Da li je HSTS header prisutan u HTTPS odgovoru?
• Da li max-age nije premali (minimum 6 meseci, idealno 1 godina)?
• Da li includeSubDomains ne pravi probleme sa HTTP-only subdomenom?

Shieldome Scout proverava sve ove aspekte automatski i signalizira potencijalne probleme.

← Blog

The Problem with Plain HTTPS Redirect

Scenario: a user types yourcompany.com into the browser. The browser automatically sends an HTTP request:

GET http://yourcompany.com/ HTTP/1.1

The server responds with a 301 redirect to HTTPS. The browser follows the redirect and establishes a secure connection.

Problem: That first HTTP request is unencrypted. An attacker performing a Man-in-the-Middle attack on the same network (coffee shop, hotel, airport) can intercept and modify that initial HTTP response — and instead of redirecting to HTTPS, redirect the user to a fake site or strip HTTPS protection (SSL stripping attack).

What Is HSTS?

HTTP Strict Transport Security (HSTS) is a mechanism that instructs the browser to automatically use HTTPS for every future request to this domain — on the browser side, before anything is sent.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

How It Works

1. The browser visits the site for the first time and receives the HSTS header
2. The browser records: "for yourcompany.com, always use HTTPS for the next 31536000 seconds (1 year)"
3. Next time the user types http://yourcompany.com, the browser converts it to HTTPS before sending the request
4. No initial HTTP request, no possibility for SSL stripping

HSTS Preload List

The HSTS header protects from the second visit onward, but what about the first? The preload list solves this too: browsers (Chrome, Firefox, Safari, Edge) come with a hard-coded list of domains that always use HTTPS — even before the first request. You can add your domain at hstspreload.org.

SSL Stripping Attack

SSLstrip (2009, Moxie Marlinspike) demonstrated how an attacker in MITM position can intercept the initial HTTP request, establish an HTTPS connection with the server on their own behalf, and serve the user an HTTP version of the site — with the user seeing no padlock. HSTS combined with the preload list makes this attack ineffective because the browser refuses HTTP communication even before sending a request.

What to Check

• Is there an HTTPS redirect for HTTP?
• Does the redirect go directly to HTTPS or through multiple hops?
• Is the HSTS header present in the HTTPS response?
• Is max-age not too small (minimum 6 months, ideally 1 year)?
• Does includeSubDomains not create problems with an HTTP-only subdomain?

Shieldome Scout checks all these aspects automatically and flags potential issues.