[websec] Re: RFC6797: Adding HSTS on an established/legacy domain in an enterprise

=JeffH <Jeff.Hodges@Kingsmountain.com> Fri, 21 March 2025 19:57 UTC

Message-ID: <8efb38fd-e95f-4eae-a86d-f94974b09807@Kingsmountain.com>
Date: Fri, 21 Mar 2025 12:57:37 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: Gunnar Guðvarðarson <gunnarg@thekking.is>, "collin.jackson@sv.cmu.edu" <collin.jackson@sv.cmu.edu>, "abarth@eecs.berkeley.edu" <abarth@eecs.berkeley.edu>
References: <AS8P193MB1302B6D1C3A32104AD8C694EB1C92@AS8P193MB1302.EURP193.PROD.OUTLOOK.COM>
Content-Language: en-US
From: =JeffH <Jeff.Hodges@Kingsmountain.com>
In-Reply-To: <AS8P193MB1302B6D1C3A32104AD8C694EB1C92@AS8P193MB1302.EURP193.PROD.OUTLOOK.COM>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Message-ID-Hash: WZCKDOTYK4MLBEJ6WC4G627KEVWXF4AH
CC: "rfc6797@ietf.org" <rfc6797@ietf.org>, "scott@scotthelme.co.uk" <scott@scotthelme.co.uk>, "troy@troyhunt.com" <troy@troyhunt.com>, websec@ietf.org
Precedence: list
Subject: [websec] Re: RFC6797: Adding HSTS on an established/legacy domain in an enterprise
Archived-At: <https://mailarchive.ietf.org/arch/msg/websec/xrO0B7LJp5xrCAKuwavF-wr6ZwM>


On 3/3/2025 9:15 AM, Gunnar Guðvarðarson wrote:
> Hey,
> 
> As you might well be aware, adding HSTS on an established, legacy domain in an enterprise is not popular, and most of the time blocked by legacy ... reasons.
> 
> I would like to propose an addition to RFC6797, a "-Report-Only" header alternative to the existing header, that while it would not actually enforce HSTS, it would instead report potential failures of the HSTS policy to the configured NEL<https://w3c.github.io/network-error-logging/#secure-connection-establishment-errors>.


Thanks for sharing your idea. However, I'm no longer active in the IETF 
and am not contributing to such work.  (and rarely reading email at this 
address)

Also, the "need" for HSTS is decreasing as browsers now support 
"HTTPS-first" behavior along with the mass adoption of HTTPS fostered by 
Lets Encrypt.  (HSTS was/is a stopgap tool).

Though, if you wish to pursue this, the way to do it is to propose it on 
the websec@ietf.org mailing list and write an internet-draft.

I hope this helps,

JeffH




> 
> Examples:
> report-to: {"group":"default","max_age":31536000,"endpoints":[{"url":"https://example.com/reports"}],"include_subdomains":true}
> nel: {"report_to":"default","max_age":31536000,"include_subdomains":true,"failure_fraction":1.0}
> 
> strict-transport-security-report-only: max-age=31536000; includesubdomains
> Or
> strict-transport-security-report-only: max-age=31536000; includesubdomains; report-to=default
> 
> Or a mix of enforcement for apex and reporting for subdomains, strictest policy always wins, so if a subdomain already has HSTS enforced, use that.
> strict-transport-security: max-age=31536000
> strict-transport-security-report-only: max-age=31536000; includesubdomains
> 
> Applying this should be fearless, since nothing changes except reports are generated, and after running that for a few months or years, and fixing any reports, you can be confident when actually enabling HSTS enforcement.
> 
> Kveðja / Regards,
> Gunnar Guðvarðarson
> Öryggissérfræðingur | Principal Security Engineer
> Skilmálar / DisclaimerLagalegur fyrirvari tölvupósts / E-mail disclaimer

[websec] Re: RFC6797: Adding HSTS on an establish… =JeffH