Question

If I have already enabled HSTS header from my server side, then why Google Chrome is ignoring it? I can access website freely with http. I am expecting that Browser should force website to load in the HTTPS only. After all, HSTS is for that purpose. Please correct me if I am wrong. Ref: Video

Connection:keep-alive
Content-Encoding:gzip
Content-Type:text/html; charset=UTF-8
Date:Mon, 18 Dec 2017 07:15:18 GMT
Link:<http://example.com/wp-json/>; rel="https://api.w.org/"
Server:nginx
Set-Cookie:wfvt_1954975060=5a376b06351b6; expires=Mon, 18-Dec-2017 07:45:18 GMT; Max-Age=1800; path=/; HttpOnly
Strict-Transport-Security:max-age=63072000; includeSubdomains;
Transfer-Encoding:chunked
Vary:Accept-Encoding

Answer 1

The {"success":true,"attr":{"x":729286.95500188,"y":4021544.8279993,"zone":40,"aboveEquator":true}} header is only valid on HTTPS pages. It is ignored on HTTP pages -- if you want to force users to use HTTPS, redirect them to HTTPS from all HTTP pages, and present a Strict-Transport-Security header on the page they are redirected to.

MDN explains why:

Note: The Strict-Transport-Security header is ignored by the browser when your site is accessed using HTTP; this is because an attacker may intercept HTTP connections and inject the header or remove it. When your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor the Strict-Transport-Security header.

Why Chrome is not forcing HTTPS if HSTS header is present?

1 个答案: