This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Test HTTP Strict Transport Security (OTG-CONFIG-007)"
(Fixed some typos, formatting, slight clean up) |
|||
| Line 3: | Line 3: | ||
== Brief Summary == | == Brief Summary == | ||
| − | |||
The HTTP Strict Transport Security (HSTS) header is a mechanism that web sites have to communicate to the web browsers that all traffic exchanged with a given domain must always be sent over https, this will help protect the information from being passed over unencrypted requests.<br> | The HTTP Strict Transport Security (HSTS) header is a mechanism that web sites have to communicate to the web browsers that all traffic exchanged with a given domain must always be sent over https, this will help protect the information from being passed over unencrypted requests.<br> | ||
Considering the importance of this security measure it is important to verify that the web site is using this HTTP header, in order to ensure that all the data travels encrypted from the web browser to the server.<br> | Considering the importance of this security measure it is important to verify that the web site is using this HTTP header, in order to ensure that all the data travels encrypted from the web browser to the server.<br> | ||
| − | |||
== Description of the Issue == | == Description of the Issue == | ||
| − | <br> | + | The HTTP Strict Transport Security (HSTS) feature lets a web application to inform the browser, through the use of a special response header, that it should never stablish a connection to the the specified domain servers using HTTP, and instead of this, it should automatically stablish all connection requests to access the site through HTTPS. |
| − | + | The HTTP strict transport security header uses two directives: | |
| − | + | max-age: to indicate the number of seconds that the browser shoud automatically convert all HTTP requests to HTTPS. | |
| + | includeSubDomains: to indicate that all web application’s subdomains must use HTTPS. | ||
| + | |||
| + | Here's an example of the HSTS header implementation:<br> | ||
| + | Strict-Transport-Security: max-age=60000; includeSubDomains | ||
| + | |||
| + | The use of this header by web applications avoids must be checked to know if the following security issues could be produced: | ||
| + | * Attackers sniffing the network traffic and accessing the information transferred through unencrypted channel. | ||
| + | * Attackers exploiting a man in the middle attack because of the problem of accepting certificates that are not trusted. | ||
| + | * Users who mistakenly entered an address in the browser putting HTTP instead of HTTPS, or users who click on a link in a web application which mistakenly indicated the http protocol. | ||
== Black Box testing and example == | == Black Box testing and example == | ||
| − | + | Testing for the presence of HSTS header could be done checking the existence of the HSTS header in the server's response in our favourite interception proxy, or using curl as follows: <br> | |
| − | $ curl -s -D- <nowiki>https:// | + | $ curl -s -D- <nowiki>https://domain.com/</nowiki> | grep Strict |
| − | + | Result expected:<br> | |
Strict-Transport-Security: max-age=14400 | Strict-Transport-Security: max-age=14400 | ||
== References == | == References == | ||
* OWASP HTTP Strict Transport Security - https://www.owasp.org/index.php/HTTP_Strict_Transport_Security | * OWASP HTTP Strict Transport Security - https://www.owasp.org/index.php/HTTP_Strict_Transport_Security | ||
* OWASP Appsec Tutorial Series - Episode 4: Strict Transport Security - http://www.youtube.com/watch?v=zEV3HOuM_Vw | * OWASP Appsec Tutorial Series - Episode 4: Strict Transport Security - http://www.youtube.com/watch?v=zEV3HOuM_Vw | ||
| + | * HSTS Specification: http://tools.ietf.org/html/rfc6797 | ||
Revision as of 00:14, 16 December 2013
This article is part of the new OWASP Testing Guide v4.
Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: https://www.owasp.org/index.php/OWASP_Testing_Project
Brief Summary
The HTTP Strict Transport Security (HSTS) header is a mechanism that web sites have to communicate to the web browsers that all traffic exchanged with a given domain must always be sent over https, this will help protect the information from being passed over unencrypted requests.
Considering the importance of this security measure it is important to verify that the web site is using this HTTP header, in order to ensure that all the data travels encrypted from the web browser to the server.
Description of the Issue
The HTTP Strict Transport Security (HSTS) feature lets a web application to inform the browser, through the use of a special response header, that it should never stablish a connection to the the specified domain servers using HTTP, and instead of this, it should automatically stablish all connection requests to access the site through HTTPS. The HTTP strict transport security header uses two directives: max-age: to indicate the number of seconds that the browser shoud automatically convert all HTTP requests to HTTPS. includeSubDomains: to indicate that all web application’s subdomains must use HTTPS.
Here's an example of the HSTS header implementation:
Strict-Transport-Security: max-age=60000; includeSubDomains
The use of this header by web applications avoids must be checked to know if the following security issues could be produced:
- Attackers sniffing the network traffic and accessing the information transferred through unencrypted channel.
- Attackers exploiting a man in the middle attack because of the problem of accepting certificates that are not trusted.
- Users who mistakenly entered an address in the browser putting HTTP instead of HTTPS, or users who click on a link in a web application which mistakenly indicated the http protocol.
Black Box testing and example
Testing for the presence of HSTS header could be done checking the existence of the HSTS header in the server's response in our favourite interception proxy, or using curl as follows:
$ curl -s -D- https://domain.com/ | grep Strict
Result expected:
Strict-Transport-Security: max-age=14400
References
- OWASP HTTP Strict Transport Security - https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
- OWASP Appsec Tutorial Series - Episode 4: Strict Transport Security - http://www.youtube.com/watch?v=zEV3HOuM_Vw
- HSTS Specification: http://tools.ietf.org/html/rfc6797
