31 August 2010

HTTP Strict Transport Security

It's good to see different groups working together to improve security. This week another browser manufacturer announced future support for an initiative relating to Transport Layer Security (TLS, the successor to SSL).

Partial view of the first page from the IETF's internet draft 'HTTP Strict Transport Security (HSTS)', 11 July 2010, from the IETF Network Working Group

HTTP Strict Transport Security (HSTS) describes a method for a web site to tell client browsers that they should only interact with it over secure transport, i.e. TLS Whilst there have been browser plugins which support this draft specification, support for HSTS was announced for v4 of Google Chrome in January, and last week for v4 of Mozilla Firefox. Hopefully Microsoft Internet Explorer 9 and ,a href="http://www.opera.com/">Opera will also adopt this.

Why is it important? Some attacks mean that TLS is vulnerable if there are redirects from non-TLS (e.g. http://www.example.com) to TLS (https://www.example.com) content. And if part, or all, of your web site is only meant to be accessed over SSL, HSTS should be implemented now, ready for mainstream adoption.

Further details are provided on the W3C page at Strict Transport Security (STS) and the draft IETF specification is at HTTP Strict Transport Security (HSTS).

Posted on: 31 August 2010 at 08:37 hrs

Comments Comments (2) | Permalink | Send Send | Post to Twitter

Comments

Comments are filtered automatically and should appear shortly after they been checked.

If your site is completely SSL except for the http://my.site.com/ initial connection that is redirected to https://my.site.com/, is there benefit here?
1 Added by Jason Rahm Posted on 13 September 2010 at 14:58 hrs
It is certainly better than having no SSL or partial SSL which is poorly implemented. But there are some risks with redirections being prone to man-in-the-middle attacks. But HSTS will help here as it hopefully becomes more widely adopted.

Try to get users to type the SSL address directly (for their own benefit).

Ensure your SSL is configured correctly.
2 Added by Clerkendweller Posted on 14 September 2010 at 10:31 hrs
Post a comment
Confirm acceptance and understanding of the terms of use
New posts to this thread will be sent to your email address
HTTP Strict Transport Security
http://www.clerkendweller.com/2010/8/31/HTTP-Strict-Transport-Security
ISO/IEC 18004:2006 QR code for http://clerkendweller.com

Page http://www.clerkendweller.com/2010/8/31/HTTP-Strict-Transport-Security
Requested by 107.20.7.65 on Wednesday, 19 June 2013 at 06:25 hrs (London date/time)

Please read our terms of use and obtain professional advice before undertaking any actions based on the opinions, suggestions and generic guidance presented here. Your organisation's situation will be unique and all practices and controls need to be assessed with consideration of your own business context.

Terms of use http://www.clerkendweller.com/page/terms
Privacy statement http://www.clerkendweller.com/page/privacy
© 2010-2013 clerkendweller.com