Skip to content

HTTP Strict Transport Security Cheat Sheet / HTTP严格传输安全备忘录

Introduction / 介绍

HTTP Strict Transport Security (also named HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header that browser will prevent any communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click through prompts on browsers.

HTTP 严格传输安全（也称为HSTS）是一种可选的安全增强功能，通过特殊响应头来指定。一旦支持该功能的浏览器接收到这个头，该浏览器将阻止任何通信通过HTTP发送到指定的域名，并将所有通信通过HTTPS发送。它还防止了浏览器上的HTTPS点击通过提示。

The specification has been released and published end of 2012 as RFC 6797 (HTTP Strict Transport Security (HSTS)) by the IETF.

规范已于2012年底发布并作为IETF RFC 6797（HTTP严格传输安全（HSTS））发布。

Threats / 威胁

HSTS addresses the following threats:

HSTS解决了以下威胁：

  • User bookmarks or manually types http://example.com and is subject to a man-in-the-middle attacker
    中文：用户将书签或手动输入 http://example.com，可能会受到中间人攻击者的攻击
    • HSTS automatically redirects HTTP requests to HTTPS for the target domain
      中文：HSTS自动将目标域的HTTP请求重定向到HTTPS
  • Web application that is intended to be purely HTTPS inadvertently contains HTTP links or serves content over HTTP
    中文：旨在完全使用HTTPS的Web应用程序意外地包含HTTP链接或通过HTTP提供服务
    • HSTS automatically redirects HTTP requests to HTTPS for the target domain
      中文：HSTS自动将目标域的HTTP请求重定向到HTTPS
  • A man-in-the-middle attacker attempts to intercept traffic from a victim user using an invalid certificate and hopes the user will accept the bad certificate
    中文：中间人攻击者尝试使用无效的证书拦截受害用户的流量，并希望用户接受这个无效的证书
    • HSTS does not allow a user to override the invalid certificate message
      中文：HSTS不允许用户覆盖无效证书的消息

Examples / 示例

This example sets a long (2 years = 63072000 seconds) max-age for the issuing host. Without includeSubDomains, this policy does not extend to its subdomains; see the subdomain cookie risks below:

此示例为发行主机设置了一个较长的max-age（2年=63072000秒）。如果没有includeSubDomains，此策略不会扩展到其子域；下面请参阅子域cookie风险：

Strict-Transport-Security: max-age=63072000

This example is useful if all present and future subdomains will be HTTPS. This is a more secure option but will block access to certain pages that can only be served over HTTP:

此示例在所有现有和未来的子域都将使用HTTPS的情况下很有用。这是一个更安全的选项，但会阻止访问只能通过HTTP提供的服务页面：

Strict-Transport-Security: max-age=63072000; includeSubDomains

This example is useful if all present and future subdomains will be HTTPS. In this example we set a very short max-age in case of mistakes during initial rollout:

此示例在所有现有和未来的子域都将使用HTTPS的情况下很有用。在此示例中，我们设置了一个非常短的max-age，以防在初始部署过程中出现错误：

Strict-Transport-Security: max-age=86400; includeSubDomains

Recommended:

推荐:

  • If the site owner would like their domain to be included in the HSTS preload list maintained by Chrome (and used by Firefox and Safari), then use the header below.
    中文：如果网站所有者希望他们的域名被包含在 Chrome 维护的 HSTS 预加载列表 中（并被 Firefox 和 Safari 使用），则请使用以下标题。
  • Sending the preload directive from your site can have PERMANENT CONSEQUENCES and prevent users from accessing your site and any of its subdomains if you find you need to switch back to HTTP. Please read the details at preload removal before sending the header with preload.
    中文：从您的网站发送 preload 指令可能会产生 永久性后果，如果您需要切换回 HTTP，这将阻止用户访问您的网站及其任何子域名。请在发送带有 preload 的头信息之前，阅读 preload 移除详情。

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

The preload flag indicates the site owner's consent to have their domain preloaded. The site owner still needs to then go and submit the domain to the list.

preload 标志表示网站所有者同意其域名预先加载。网站所有者随后还需要提交域名到列表中。

Problems / 问题

Site owners can use HSTS to identify users without cookies. This can lead to a significant privacy leak. Take a look here for more details.

网站所有者可以使用 HSTS 来识别用户而不使用 cookies。这可能导致严重的隐私泄露。更多详情请参阅此处。

Cookies can be manipulated from sub-domains, so omitting the includeSubDomains option permits a broad range of cookie-related attacks that HSTS would otherwise prevent by requiring a valid certificate for a subdomain. Ensuring the secure flag is set on all cookies will also prevent, some, but not all, of the same attacks.

Cookies 可以从子域名被操纵，因此省略 includeSubDomains 选项允许一系列与 cookie 相关的攻击，这些攻击 HSTS 通过要求子域有效证书来防止。确保所有 cookies 都设置了 secure 标志也将防止一些，但不是所有相同的攻击。

Browser Support / 浏览器支持

As of September 2019 HSTS is supported by all modern browsers, with the only notable exception being Opera Mini.

截至 2019 年 9 月，所有现代浏览器都支持 HSTS（caniuse.com），唯一值得注意的例外是 Opera Mini。

For TLS configuration, see the Transport Layer Security Cheat Sheet.

有关 TLS 配置，请参阅传输层安全性速查表。

References / 参考