HSTS VS 301 redirect

Before the HTTPS service based on nginx configuration for the site, the configuration process involves two knowledge points:

301 permanent redirect
HTST(HTTP Transport Security Protocol)

This paper comb through concepts, clarify the purpose of these configurations.

HTTPS

HTTPS, also claim called HTTP over TLS, TLS is the predecessor SSL. HTTPS provides data integrity compared to HTTP, data privacy and authentication features.

SSL communication process

HTTPS client initiates a request, provide client support encryption algorithm and a random number client_random client to the server
Server back to the client configured server public key certificate and a random number server_random
Client verifies the public key certificate, such as whether or not within the validity period, whether the domain name matching; If the certificate is valid, the client uses public key encryption to encrypt a random number provided by the server premaster secret, to the server
The server uses its private key to decrypt premaster secret
The client and server random number three previous stage, using the negotiated encryption algorithm to generate a master secret, behind both the communication using the encrypted symmetric key;

In the configuration nginx

Request a certificate

In the configuration nginx.conf

server {
    listen 443;
    server_name www.example.com; #填写绑定证书的域名
    ssl on;
    ssl_certificate /etc/nginx/sslconfig/1_www.example.com_bundle.crt;
    ssl_certificate_key /etc/nginx/sslconfig/2_www.example.com.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; 
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    location / {
        root   html; #站点目录
        index  index.html index.htm;
        # proxy_pass http://$server_name:8920;
}
复制代码

Middle attack (MitM)

Middle attack (Man-in-the-middle attack, abbreviation: MITM) refers to the establishment of an independent link ends of each attacker and communications, and exchanging data it receives, so that both ends of the communication think they are through a intimate connection direct dialogue with each other, but in fact the entire session are completely controlled by the attacker and data tampering and sniffing.

Proxy (mitmproxy): as a proxy server in HTTP and HTTPS traffic middleman, and client communications when it is disguised as a server, disguised as client and server communications, the content of the communication on both sides decoded. The proxy server generates fake certificates to deceive the client, to make the client trust forged certificate without warning, the client needs a proxy server manually registered as a trusted CA.
SSL stripping (SSLsplit): SSL stripping, the attacker SSLStrip also served as an intermediary role, to maintain HTTPS connection between the intermediary and the server, and the client maintain HTTP connection, which is to downgrade HTTPS to HTTP. Since HTTP is transmitted in the clear, so an attacker could steal the contents of the communication.
Session hijacking (Session Hijacking): attacker to steal or destroy a session token predicted by a valid session tokens to gain unauthorized access to the Web server. Commonly used method to steal Cookie / session tokens are sniffing sessions and cross-site scripting attacks.
Defense: For the communication and information exchange letters line real life, the man in the middle attacks are difficult to prevent, and some tips:
- Do not ignore the pop-up browser certificate warning! You may access a phishing website or fake server
- Under public network environment (such as public WiFi), no HTTPS encryption of sensitive sites should not logged in, the general can not be trusted
- Sign in front of their accounts to ensure that any URL on the site is encrypted HTTPS protocol to go

HSTS

HSTS , i.e. the HTTP Strict-Transport-Security . When the operation site via HTTPS, the server returns a response header Strict-Transport-Security, after forcing the browser to communicate using HTTPS.

Strict-Transport-Security: max-age=<expire-time>
Strict-Transport-Security: max-age=<expire-time>; includeSubDomains
Strict-Transport-Security: max-age=<expire-time>; preload
复制代码

A site accepts an HTTP request, and then jump to HTTPS, users may start before the jump, no encryption by way of dialogue and servers, so there is a potential threat to middle attack, a jump process can be malicious website to direct contact with the user information, rather than the original encrypted information.
After HTST is connected and safe return visit by the head HTTPS for the first time, the browser records the information. Within the validity period, when the browser tries to re-establish a connection to the server via HTTP will return to 307 Temporary Redirectthe browser from loading HTTP information, and connect redirected to HTTPS. The results of a test are as follows:

In response to the configuration information nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
复制代码

Browser return results

Note HTST head is provided, if the HTTP response is ignored by HTTPS. One solution strategy is PRELOAD HTST . HSTS preloaded is to put your website and domain name or on an approved list hsts, this list is actually built into the browser. Google provides this service list by Chrome, Firefox, Opera, Safari, IE11 and Edge use, you can submit your site to the official HSTS preloaded list.

301 redirect

HTTP 301 永久重定向Description The requested resource has been moved to the specified by the Location header url, is fixed will not change, the search engine will be fixed according to the response, in the SEO 301 jump right to re-site will have an impact.
We note that we have nginx has been configured return 301 https://$server_name$request_uri, redirects HTTP requests to HTTPS. However, in front of the browser test results, access via HTTP and does not show 301 permanent redirect, but 307 temporary redirect. In fact, the 301 is still happening, 301 redirect on the server level, and 307 redirect the browser level. We httpstatus testing, you can visually see the results:

We have shown HSTS and the role of 301, but we may still be a little confused:

Why has the use of 301 redirects, but also the use HSTS?
Why most sites use a 301 redirect instead of preloading HSTS alternative?

Differences and relations

HSTS cover the domain name, while 301 redirect for a specific URL Path;
Meaning HSTS designed to address security issues, and 301 more in order to fix the redirect, it came to be widely used in the upgrade from HTTP to HTTPS in the process, and the weight of the impact site search;
HSTS role in the case visited at least once HTTPS certificate validation and success, at higher security requirements we force the use of HTTPS, which requires mandatory pre-loaded or redirect; if the attacker has been established to prevent HTTPS website connection, HTST will not work;
Most sites currently use HSTS is used in conjunction with 301 redirect instead of preloading, this may be due to compatibility reasons;
HSTS compared to 301 redirect, performance and security may have some advantages. 301 caches and other requests as are stored in the browser cache redirection will consume performance; and HSTS retained in a separate buffer list, can keep longer without being cleared browser;
Middle attack might exploit the opportunity to be redirected to intervene, but HSTS can effectively deal with SSL stripping (HTTPS downgrade) lead to security problems, but for other types of middle attack may not work.
HSTS often and HPKP (HTTP Public Key Pinning) used in combination, HPKP allow HTTPS sites specify the certificate trust, and instruct the browser does not allow any site connected to protection by any other certificate.

In short, the man in the middle attack is not possible simply by a certain kind of strategy to completely stop, but better than nothing, HSTS is still a viable security policy.

Reference to some blog and discussion, please correct me if wrong.

Reference material

Reproduced in: https: //juejin.im/post/5d010fb0f265da1bb80c275a