HTTP Strict Transport Security (HSTS) & Preload List: Mitigating SSL Stripping attacks.

Defeating the Moxie Marlinspike SSL Stripping Attack

When users type example.com into a browser address bar, the browser initially connects via unencrypted plain HTTP (http://example.com). The server then sends an HTTP 301 redirect to https://example.com. An attacker on the same local network (public Wi-Fi, coffee shop) can intercept that initial HTTP request (SSL Stripping), proxy the HTTPS connection to the real server, and serve plain HTTP to the victim.

Victim Browser <==== HTTP (Insecure) ====> [ Attacker / sslstrip ] <==== HTTPS ====> [ Real Bank ]

1. HSTS Response Header

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

• max-age=63072000: Informs the browser that for the next 2 years, it must never send unencrypted HTTP requests to this domain. The browser automatically rewrites http:// to https:// internally before sending packets.
• includeSubDomains: Enforces HTTPS across all existing and future subdomains (api.example.com, admin.example.com).

2. The Chromium HSTS Preload List

HSTS headers only take effect after the browser visits the site at least once (Trust-On-First-Use). To eliminate the initial vulnerability window, submit your domain to the HSTS Preload List (hstspreload.org). The domain is hardcoded directly into the binary source code of Chrome, Firefox, Safari, and Edge, ensuring that even the first connection ever made is strictly HTTPS.