Description Michael Grandjean 2015-01-27 20:20:38 CET

HSTS is a mechanism to enforce website encryption and is designed to mitigate certain man-in-the-middle-attacks. Basically, HSTS informs the browser to always attempt to access the site using HTTPS instead of HTTP¹. This adds security by default in terms of mixed content issues, cookie security and e.g. preventing HTTPS stripping attacks². I consider this a desirable feature, especially if one makes a webservice publicly available (think: cloud, webmail etc). 

Enabling HSTS should be as easy as adding the following line to the <VirtualHost *:443>-Section:

> Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

An additional security feature of HSTS is that all certificate errors are treated as fatal - that means the user is NOT allowed to click through and add an exception if the browser does not trust the certificate. Unfortunately this is not desirable in a default UCS scenario since the certificates there are self-signed. So to make use of HSTS one has either to import the UCS CA root certificate in the browsers trusted store or to use a certificate that is signed by a trusted CA. Because of this, HSTS should be disabled by default and documentation provided on how to enable it.

To make full use of HSTS/HTTPS-only one has to also redirect HTTP to HTTPS via apache (see Bug 25647) (e.g. for HSTS to kick in it is required that the browser has intentionally accessed the HTTPS-site once before). Alternatively browsers maintain a built-in list (preload) of domains that are known to have HSTS deployed. So far one has to contact the browser vendors to get on these lists³.

¹ https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
² http://www.thoughtcrime.org/software/sslstrip/
³ https://hstspreload.appspot.com/