Use Strict-Transport-Security header (strict-transport-security)

strict-transport-security warns against serving resources over HTTPS without strict-transport-security header and validates the header directives and their corresponding values.

Why is this important?

Web security should be a critical concern for web developers. Unlike cross-site scripting (XSS) and SQL injection, the exploit of insufficient protection over the transport layer can be harder to picture in practice. If a website accepts a connection through HTTP and then redirects to HTTPS, it opens opportunities for a "man-in-the-middle" attack, when the redirect could be exploited and lead the user to a malicious site.

By specifying the Strict-Transport-Security header along with a max-age value in the response, a website can declare that only secure connections within the specified period will be accepted. For future requests to the same domain via insecure connections, the browser knows that it should never load the site using HTTP and automatically converts all requests to HTTPS instead.

Notably, to prevent the Strict-Transport-Security header from being stripped by the attacker on the user’s first visit, major browsers include a "pre-loaded" list of sites that must be loaded via HTTPS. You can submit your domain name in the online form to be included in the list. After being included, all insecure connection requests will be disallowed. Use with great caution: Before you decide to have your own domain included, make sure that you can support HTTPS for all the subdomains and that you'll never again need the insecure scheme.

More information about HTTP Strict Transport (HSTS), please see:

• HTTP Strict Transport Security wiki
• HTTP Strict Transport Security Cheat Sheet

What does the hint check?

For a site served over HTTPS, this hint checks the following:

• If it has a Strict-Transport-Security header.
• If the header has the required max-age directive.
• If the max-age directive has a value that is longer than 18 weeks (10886400s).
• If Strict-Transport-Security header has repetitive directives.
• When a Strict-Transport-Security header contains the preload directive, this hint will first check the domain name against the HTTP Strict Transport Security (HSTS) preload list for the preload status, and then check whether this domain has errors that would prevent preloading by calling the HSTS Preload API endpoint. This check is disabled by default.

Examples that trigger the hint

Strict-Transport-Security response header was not sent over HTTPS:

HTTP/... 200 OK

...

Strict-Transport-Security response header is sent with a max-age value that is too short:

HTTP/... 200 OK

...
Strict-Transport-Security: max-age=1

Strict-Transport-Security response header is sent without max-age directive:

HTTP/... 200 OK

...
Strict-Transport-Security: maxage=31536000

Strict-Transport-Security response header is sent with duplicate includeSubDomains directives:

HTTP/... 200 OK

...
Strict-Transport-Security: includeSubDomains; max-age=31536000; includeSubDomains

Examples that pass the hint

HTTP/... 200 OK

...
Strict-Transport-Security: max-age=31536000

HTTP/... 200 OK

...
Strict-Transport-Security: max-age=31536000; includeSubDomains

HTTP/... 200 OK

...
 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

How to configure the server to pass this hint

Apache can be configured to serve resources with the Strict-Transport-Security header with a specific value using the Header directive, e.g.:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
</IfModule>

Note that:

• The above snippet works with Apache v2.2.0+, but you need to have mod_headers enabled in order for it to take effect.

• If you have access to the main Apache configuration file (usually called httpd.conf), you should add the logic in, for example, a <Directory> section in that file. This is usually the recommended way as using .htaccess files slows down Apache!

  If you don't have access to the main configuration file (quite common with hosting services), add the snippets in a .htaccess file in the root of the web site/app.

For the complete set of configurations, not just for this rule, see the Apache server configuration related documentation.

IIS can be configured to serve resources with the Strict-Transport-Security header with a specific value using the <customHeader> element. E.g.:

<configuration>
     <system.webServer>
        <httpProtocol>
             <customHeaders>
                <add name="Strict-Transport-Security" value="max-age=31536000"/>
             </customHeaders>
         </httpProtocol>
    </system.webServer>
</configuration>

Note that:

• The above snippet works with IIS 7+.
• You should use the above snippet in the web.config of your application.

For the complete set of configurations, not just for this rule, see the IIS server configuration related documentation.

Can the hint be configured?

Yes, you can configure the value that max-age is checked against in the .hintrc file. By default, this limit is set as 18 weeks (10886400s);

E.g. The following configuration will change the max-age value limit to 123456.

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "strict-transport-security": ["error", {
            "minMaxAgeValue": 123456
        }],
        ...
    },
    ...
}

Also, you can configure the hint so that if the preload directive is included in the header, it will check whether this domain has errors that would prevent preloading by calling the hstspreload api endpoint. This validation is disabled by default.

E.g. The following configuration will enable the preload validation.

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "strict-transport-security": ["error", {
            "checkPreload": true
        }],
        ...
    },
    ...
}

How to use this hint?

This package is installed automatically by webhint:

npm install hint --save-dev

To use it, activate it via the .hintrc configuration file:

{
    "connector": {...},
    "formatters": [...],
    "hints": {
        "strict-transport-security": "error",
        ...
    },
    "parsers": [...],
    ...
}

Note: The recommended way of running webhint is as a devDependency of your project.

Further Reading

• The beginners guide to breaking website security with nothing more than a Pineapple
• Understanding HTTP Strict Transport Security(HSTS) and preloading it into the browser