HSTS Warnings

[unrolled]

HSTS Warnings

[amotmot]

• In general, the value of a year is used (31536000)
• @jpillora, HSTS can be removed by the server sending max-age=0

[jpillora]

Though the removal needs to be served from HTTPS, so you wouldn't want to
accidentally enable HSTS with an HTTP only site - even for 1 year instead
of 10.

On Tuesday, April 28, 2015, gellerb [email protected] wrote:

• In general, the value of a year is used (31536000)
• @jpillora https://github.com/jpillora, HSTS can be removed by the
  sender sending max-age=0

—
Reply to this email directly or view it on GitHub
#1 (comment).

[amotmot]

If one accidentally enabled HSTS on an HTTP-only site nothing would happen. The application isn't listening on port 443 if it's an HTTP-only site and HSTS is only accepted over HTTPS. In other words, the browser ignores the HSTS header over HTTP even if the application provides it.

[jpillora]

Ah I thought I'd previously accidentally enabled it one time and was forced to go into chromes net internals to wipe it, my mistake

[unrolled]

I'm debating if it's a good idea to remove theStrict-Transport-Security header from HTTP requests to avoid confusion... but then again it's kind of a nice verification the headers are coming through properly when running on a non-secure localhost connection. Or maybe always add it when isDevelopment is true, otherwise only on HTTPS connections.

Thoughts @jpillora @gellerb ?

[jpillora]

For verification and to avoid magic behaviour, probably best to leave it as is, the extra few bytes won't hurt

[amotmot]

Per the spec at the bottom of section 7.2 [1].
"An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport."

[1] http://tools.ietf.org/html/rfc6797#section-7.2

[unrolled]

Thanks for digging that up @gellerb! I'm going to investigate and see how to best handle this.